--- title: "0 of 16 vulnerability products test the attack: validation is CTEM's missing step" summary: "Gartner's five CTEM stages checked against the 16 products in TechBag's vulnerability and exposure guide, and the Indian price of the one validation option, as of September 2026." url: https://www.thetechbag.com/blog/combining-automated-security-validation-asv-continuous-threat format: Note desk: "Security operations" published: 2026-05-05 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["CTEM","exposure management","adversarial exposure validation","breach and attack simulation","VAPT","vulnerability management","RBI","SEBI CSCRF"] cover: https://www.thetechbag.com/blog/covers/combining-automated-security-validation-asv-continuous-threat.png --- # 0 of 16 vulnerability products test the attack: validation is CTEM's missing step *Gartner's five CTEM stages checked against the 16 products in TechBag's vulnerability and exposure guide, and the Indian price of the one validation option, as of September 2026.* Note · Security operations · By TechBag · Published 2026-05-05 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/combining-automated-security-validation-asv-continuous-threat The short version - Validation is the CTEM stage where an attack is actually tried. None of the 16 products in our vulnerability and exposure guide automates it; one is a human penetration test.[1] - Gartner now files the tools that do it, breach and attack simulation and automated penetration testing, under one name: adversarial exposure validation.[3] - For most Indian mid-market teams, validation today is the empanelled pentest plus a re-test of every fix. Buy a platform when that stops keeping up. The 2024 version of this piece argued that automated security validation works best inside a CTEM programme. That is still right. The question it skipped is the one a buyer has: does the scanner or exposure platform I already pay for do the validating, or is it another contract? ## Five stages, and only one tries the attack Gartner introduced continuous threat exposure management in 2022 with five stages: scoping, discovery, prioritisation, validation and mobilisation.[2] Scoping is a decision about which business systems matter, so no product does it. We checked the other four against how TechBag’s guide records each product. **Figure: Discovery and prioritisation are crowded; automated validation is empty** *Number of the 16 products in TechBag's vulnerability & exposure guide that automate each CTEM stage, as of 30 September 2026* Discovery scans or inventories exposures 14 products Prioritisation ranks by exploit risk, not CVSS alone 12 products Validation runs the attack; 1 human pentest service 0 products Mobilisation patches or mitigates itself 6 products | | Value (products) | | --- | --- | | Discovery | 14 | | Prioritisation | 12 | | Validation | 0 | | Mobilisation | 6 | Source: TechBag vulnerability & exposure management guide, TechBag count · as of 30 September 2026 · Scoping is excluded: it is a business decision, not a product function TechBag countTechBag count Discovery counts the scanners, exposure platforms and OT product plus Action1 and Sophos Managed Risk; it leaves out Qualys Patch Management and the Mitigata VAPT service. Prioritisation counts products whose scoring weighs exploit activity. Mobilisation counts the four that patch and the two that apply mitigations. The attack-path views in Tenable One and its peers model a route; they do not execute one, so they are not counted as validation. The guide itself says no breach and attack simulation product is listed. ## What a validation tool costs, and when to buy one In 2025 Gartner published a Market Guide for Adversarial Exposure Validation, a category that, in a named vendor’s summary, brings breach and attack simulation, automated penetration testing and red teaming together; the same release quotes Gartner expecting 40% of organisations to have formal exposure validation initiatives by 2027.[3] These tools are quote-only. So is the exposure layer beneath them: Tenable One is reported from about US$50,000 a year.[1] Our view Our view: a team that closes fewer findings a month than its scanner raises gains nothing from proving more of them exploitable. Fix mobilisation first. The case against us: Gartner’s 2022 prediction that CTEM adopters would be three times less likely to be breached by 2026 is now due, and as of March 2026 no breach-rate study had tested it either way.[2] ## Cost and rules in India The one validation option in the guide is human: Mitigata’s VAPT service (Mitigata is not on CERT-In’s list of empanelled auditors), listed from ₹52,000 an application and invoiced with 18% GST; TechBag resells it.[1] Validation platforms are USD quotes, invoiced in INR with GST. RBI’s Directions of 31 July 2026 ask banks for a vulnerability assessment every six months and a penetration test every twelve on internet-facing systems,[4] and SEBI’s CSCRF has applied to regulated entities since 31 August 2025.[5] How we did this Figures as of 30 September 2026 Stage counts are TechBag’s, from the field values of the 16 products in the vulnerability and exposure guide as committed on 30 September 2026; each product is counted once per stage it automates. Gartner’s documents are paywalled and are cited through dated vendor summaries. The RBI Directions are cited through a practitioner summary; the RBI text was not read for this note. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [TechBag, Vulnerability & exposure management guide (16 products; scoring, remediation and pricing fields)](https://www.thetechbag.com/browse/security/vulnerability-management) — vendor-doc-verified 22 August 2026; version of 30 September 2026 2. [Vectra AI, CTEM explained (Gartner's 2022 framework, five stages, the 2026 prediction and its validation status)](https://www.vectra.ai/topics/ctem) — 27 March 2026 3. [Picus Security, recognition in the Gartner Market Guide for Adversarial Exposure Validation (category scope; 2027 forecast)](https://www.aap.com.au/aapreleases/globenewswire9414071/) — 1 April 2025 4. [RBI, Cybersecurity, Technology Risk and Resilience Framework Directions, 2026 (RBI/DoS/2026-27/410), via practitioner summary](https://taxguru.in/rbi/rbi-issues-commercial-banks-cybersecurity-technology-risk-resilience-framework-directions-2026.html) — 31 July 2026 RBI text not read for this note. 5. [SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities](https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html) — 20 August 2024; in force 31 August 2025 Related on TechBag: the [vulnerability & exposure guide](https://www.thetechbag.com/browse/security/vulnerability-management) compares the 16 products counted here; the [Mitigata VAPT page](https://www.thetechbag.com/mitigata/mitigata-vapt) covers its manual test. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Vulnerability & exposure management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — the 16 products counted here, by scoring and remediation - [Mitigata VAPT](https://www.thetechbag.com/mitigata/mitigata-vapt) — the CERT-In-empanelled test, quoted in INR