Why think in steps?
Attack surface management, ASM, and its external form, EASM, began as an inventory job: find every internet-facing asset an organization owns, including the ones nobody wrote down. That job still matters. But an inventory does not reduce risk on its own. A list of four thousand hosts with severity labels is a work queue, and a work queue nobody can finish is just a longer list.
Breaking the work into steps makes it easier to see where a program stalls and which tools help at which point. We use six.
Step 1: found
The asset is discovered without being on anyone's list. Typical finds are forgotten test servers, domains registered by a marketing agency, infrastructure inherited in an acquisition and systems run by suppliers. Discovery techniques differ: some tools start from a company name, some from domains or IP ranges you supply, some from scans of the whole internet. Almost every product sold as ASM documents this step.
Step 2: owned
The asset is attributed to someone who can act: a subsidiary, a business unit, a named owner. Without this step a finding has nowhere to go. In large enterprises with many subsidiaries, attribution is often harder than discovery, because the same brand can sit under several legal entities and several IT teams.
Step 3: proven
The weakness is shown to be exploitable, by a safe test, rather than inferred from a software version or a severity score. This is the step that turns thousands of findings into the handful that matter this week. Lessons 2, 4 and 5 cover it in detail.
Step 4: contained
If the real fix will take days or weeks, something holds the line in the meantime: a web application firewall rule that blocks the attack path, an automated playbook, or reclaiming an asset an attacker could take over, such as an expired domain. Containment is not a fix. It buys time. Lesson 7 covers the options.
Step 5: routed
The work reaches the owner as a ticket or workflow item with enough evidence to act on: what, where, why it matters and what to do. Lesson 8 covers what a good ticket carries.
Step 6: rechecked
After the owner says it is fixed, the exposure is tested again. Without a retest, "closed" means "someone clicked a button". Lesson 9 covers retesting.
How does this map to CTEM?
Gartner describes continuous threat exposure management, CTEM, as a program for continually evaluating the accessibility, exposure and exploitability of an organization's digital and physical assets. The six steps above are a practical slice of that idea for internet-facing assets. CTEM is the program; ASM tools supply much of the discovery and, increasingly, the validation inside it.
How do vendors describe the steps?
Vendors use their own words. IONIX, for example, lists six stages on its homepage: discovery, inventory, assessment, validation, prioritization and remediation. Other vendors describe red teaming, exposure validation or remediation acceleration. Under the labels, the useful question is the same: which of the six steps does the product document, and which does it leave to you?
How does this site use the steps?
Every tool on this site has a closure track: six stations, one per step, filled where the vendor's own pages describe that step. The track is evidence, not a score. The scores sit on the rankings page, and the method page explains how the two connect.