0 of 16 vulnerability products test the attack: validation is CTEM's missing step
Gartner's five CTEM stages checked against the 16 products in TechBag's vulnerability and exposure guide, and the Indian price of the one validation option, as of September 2026.
The 2024 version of this piece argued that automated security validation works best inside a CTEM programme. That is still right. The question it skipped is the one a buyer has: does the scanner or exposure platform I already pay for do the validating, or is it another contract?
01Five stages, and only one tries the attack
Gartner introduced continuous threat exposure management in 2022 with five stages: scoping, discovery, prioritisation, validation and mobilisation.2 Scoping is a decision about which business systems matter, so no product does it. We checked the other four against how TechBag’s guide records each product.
Discovery and prioritisation are crowded; automated validation is empty
Number of the 16 products in TechBag's vulnerability & exposure guide that automate each CTEM stage, as of 30 September 2026
Source: TechBag vulnerability & exposure management guide, TechBag count · as of 30 September 2026 · Scoping is excluded: it is a business decision, not a product function
02What a validation tool costs, and when to buy one
In 2025 Gartner published a Market Guide for Adversarial Exposure Validation, a category that, in a named vendor’s summary, brings breach and attack simulation, automated penetration testing and red teaming together; the same release quotes Gartner expecting 40% of organisations to have formal exposure validation initiatives by 2027.3 These tools are quote-only. So is the exposure layer beneath them: Tenable One is reported from about US$50,000 a year.1
03Cost and rules in India
The one validation option in the guide is human: Mitigata’s VAPT service (Mitigata is not on CERT-In’s list of empanelled auditors), listed from ₹52,000 an application and invoiced with 18% GST; TechBag resells it.1 Validation platforms are USD quotes, invoiced in INR with GST. RBI’s Directions of 31 July 2026 ask banks for a vulnerability assessment every six months and a penetration test every twelve on internet-facing systems,4 and SEBI’s CSCRF has applied to regulated entities since 31 August 2025.5
Sources
- TechBag, Vulnerability & exposure management guide (16 products; scoring, remediation and pricing fields) — vendor-doc-verified 22 August 2026; version of 30 September 2026
- Vectra AI, CTEM explained (Gartner's 2022 framework, five stages, the 2026 prediction and its validation status) — 27 March 2026
- Picus Security, recognition in the Gartner Market Guide for Adversarial Exposure Validation (category scope; 2027 forecast) — 1 April 2025
- RBI, Cybersecurity, Technology Risk and Resilience Framework Directions, 2026 (RBI/DoS/2026-27/410), via practitioner summary — 31 July 2026 RBI text not read for this note.
- SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities — 20 August 2024; in force 31 August 2025
Related on TechBag: the vulnerability & exposure guide compares the 16 products counted here; the Mitigata VAPT page covers its manual test.
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
