A new 2026 market intelligence study of 128 enterprise security decision-makers (available here) reveals a stark divide forming between organizations – one that has nothing to do with budget size or industry and everything to do with a single framework decision. Organizations implementing Continuous Threat Exposure Management (CTEM) demonstrate 50% better attack surface visibility, 23-point higher solution adoption, and superior threat awareness across every measured dimension. The 16% who’ve implemented it are pulling away. The 84% who haven’t are falling behind.
The Demographics of the Divide
The research surveyed a senior cohort: 85% of respondents are Manager-level or above, representing organizations where 66% employ 5,000+ people across finance, healthcare, and retail sectors.
Download the full research here →
What is CTEM?
If you aren’t familiar, CTEM involves shifting from “patch everything reactively” to “continuously discover, validate, and prioritize risk exposures that can actually hurt the business.” It’s widely discussed in cybersecurity now as a next-generation evolution of exposure/risk management, and the new report reinforces Gartner’s view that businesses adopting it will consistently demonstrate stronger security outcomes than those that don’t.
Awareness Is High. Adoption Is Rare.
One surprising finding: There doesn’t seem to be a problem with awareness, just implementation. 87% of security leaders recognize the importance of CTEM, but only 16% have translated that awareness into operational reality. So, if they’ve heard of it, why aren’t they using it?
The gap between awareness and implementation reveals modern security’s central dilemma: which priority wins? Security leaders understand the CTEM conceptually but struggle to sell its benefits in the face of organizational inertia, competing priorities, and budget constraints that force impossible tradeoffs. The challenge of gaining management buy-in is one reason why we prepared this report: to provide the statistics that make the business case impossible to ignore.
Complexity is the New Multiplier
For example: Beyond a certain threshold, manual tracking of all the additional integrations, scripts, and dependencies breaks down, ownership blurs, and blind spots multiply. The research makes it clear that attack surface complexity is not just a management challenge; it’s a direct risk multiplier.
We can see this clearly in the graph below. Attack rates rise linearly from 5% (0-10 domains) to 18% (51-100 domains), then rise steeply past 100 domains.
This sudden increase is driven by the ‘visibility gap’, the gulf between the assets a company is responsible for monitoring and those it’s aware of. Each additional domain can add dozens of connected assets, and when the count climbs past 100, this can translate to thousands of additional scripts: each one a possible attack vector. Traditional snapshot security cannot hope to log and monitor them all. Only CTEM-driven programs can provide the oversight to continuously identify and validate the dark assets hiding in this visibility gap – before attackers do.
Why This Matters Now
Security leaders are currently facing a ‘perfect storm’ of demands. At a time when 91% of CISOs report an increase in third-party incidents, average breach costs have climbed to $4.44M, and PCI DSS 4.0.1 brings stricter monitoring and the ever-present specter of penalties. With this in mind, the report shows that attack surface management has become an issue for the boardroom as much as the server room, and the C-suite reader can only conclude that continuing to trust manual oversight and periodic controls to manage such a complex, high-stakes challenge would be self-destructive.
One of the clearest signals in this research comes from the peer benchmarking data. When organizations compare themselves side by side – by attack surface size, visibility, tooling, and outcomes – a pattern emerges that is difficult to ignore: beyond a certain level of complexity, traditional security approaches stop scaling.
The takeaway from the peer benchmarks is clear: below a certain level of exposure, organizations can rely on periodic controls and manual oversight. Above it, those models no longer hold. For security leaders operating in high-complexity environments, the question is no longer whether CTEM is valuable – it is whether their current approach can realistically keep up without it.
Download the full market research here.
