Find & Fix Exposure
Continuous Threat Exposure Management
Continuously discover, prioritise, and validate the exposures an attacker could use against you, so your team works a short, trustworthy list of what to fix first, delivered through Sentry.
Free exposure snapshot
What does an attacker see when they look at your domain?
One passive look, with the results in Sentry. We check:
- Exposed hostnames
- Lookalike domains
- Email and website settings
- Staff credentials in breach data
Nothing is checked until you confirm your work email.
- One continuous picture of exposure
- No unknown assets
- Evidenced prioritisation
- Reduced exposure windows
- Compliance evidence on demand
| Feature | CoreThe full platform. You take it from there. | ManagedCore, plus a named analyst |
|---|---|---|
| Exposure coverage | ||
| Infrastructure | ||
| Cloud security | ||
| Web applications & APIs | ||
| Attack Surface Management | ||
| Domain Monitoring | ||
| Breach & Credential Monitoring | ||
| Attack Path Analysis | ||
| Scanning & detection | ||
| Automated scanning of all registered assets on agreed cadence | ||
| Results in Sentry automatically after every scan | ||
| Trend analysis (new / remediated / persisting over time) | ||
| On-demand re-scans (outside cadence) | ||
| Verification & triage | ||
| AI enrichment on every finding: confidence, severity re-ranking, contextual risk | ||
| Bespoke AI remediation guidance per finding | ||
| Agentic verification: findings proven against your systems wherever they can be | ||
| Verified false positives kept off your list | ||
| Every finding we keep off your list checked by an analyst | – | |
| Follow-up on findings that need attention | You lead | Analyst-led |
| Platform & workflow | ||
| Full Sentry access for all client users | ||
| Ticketing integration (built into Sentry) | ||
| False-positive marking & remediation status tracking | ||
| Compliance-aligned reporting (ISO 27001, PCI DSS, Cyber Essentials) | ||
| Initial onboarding, asset registration & scan configuration | ||
| Scheduling, execution & platform support | ||
| Add / remove assets from scope during subscription | ||
| Your analyst | ||
| A named analyst who knows your estate | – | |
| Monthly summary of your exposure, and a call to go through it | – | |
| Add-on, on either plan | ||
| Remediation support, by the hour: driving fixes to closure with your teams, tailored metrics and strategic reviews | Add-on | Add-on |
Every subscription is scoped to your environment. Get a quote for exact coverage and pricing.
Continuous threat exposure management (CTEM) is the practice of continuously discovering, prioritising, and validating the exposures an attacker could use against your organisation, rather than relying on periodic scans and annual assessments that age the moment they finish.
Sentry CTEM is Blackfoot's managed CTEM service. It combines continuous attack surface discovery, automated vulnerability scanning across infrastructure, applications, and cloud, lookalike-domain detection, leaked-credential monitoring, and attack path analysis. It then applies AI enrichment and agentic verification, which tests findings against your systems wherever they can be proven, so that what reaches your team is a short, trustworthy, prioritised list of what to fix first. Everything is delivered through the Sentry platform.
It is particularly relevant to organisations facing compliance obligations under ISO 27001, PCI DSS, or Cyber Essentials, those with cyber insurance requirements for continuous scanning evidence, and any organisation whose estate changes faster than its assessment cycle.
Get a quote for Continuous Threat Exposure Management
Tell us your scope and objectives, and we’ll come back with a clear, fixed proposal, usually the same working day.
Get a Quoteor call +44 (0) 203 393 7795- CREST-accredited
- UK-based specialists
- Crown Commercial Service supplier
How it works
- 01
Scope
Onboarding captures your seed assets, scan domains, and the assets that matter most to your business.
- 02
Discover
Continuous discovery maps your internet-facing estate while scheduled scanning assesses infrastructure, applications, and cloud posture; domain and credential monitoring watch for impersonation and leaks.
- 03
Prioritise
Every finding is AI-enriched with contextual severity, confidence, and remediation guidance.
- 04
Validate
Our verification agents test findings against your systems wherever they can be proven, and keep the false positives they disprove off your list. On Managed, an analyst checks every one they keep off it.
- 05
Mobilise
Findings land in Sentry with clear ownership, tracking, and compliance-aligned reporting. Blackfoot optionally drive remediation.
One continuous threat exposure management programme, five modules
Sentry CTEM brings together five modules: attack surface management, continuous vulnerability management, domain monitoring, breach and credential monitoring, and attack path analysis. Modules are available standalone, and all run on the Sentry platform, so you can start with the coverage you need today and expand to the full programme without re-onboarding.
The service is delivered remotely on subscription, in two tiers. Core is the whole platform: every module, AI enrichment, agentic verification and attack path analysis. Managed adds a named analyst who follows up on the findings that need attention and reviews your exposure with you every month. Hands-on remediation support is available by the hour on either tier. Every tier includes full Sentry access, ticketing integration, and compliance-aligned reporting.
Why Blackfoot
Blackfoot is a CREST-accredited cybersecurity consultancy delivering technical security services across financial services, healthcare, professional services, retail, and technology sectors. Sentry CTEM is delivered by the team responsible for Blackfoot's penetration testing practice, meaning verification is designed and overseen by practitioners with hands-on offensive security experience, not just tool operators. The Sentry platform underpins CTEM and Blackfoot's penetration testing engagements, giving clients a single consolidated view across continuous exposure management and point-in-time assessment.
What you get
One continuous picture of exposure
Assets, vulnerabilities, cloud posture, brand impersonation, and leaked credentials in a single platform.
No unknown assets
Continuous discovery finds shadow IT and forgotten hosts before attackers do, and feeds them straight into scanning.
Evidenced prioritisation
AI enrichment and agentic verification mean your team works a short, prioritised, trustworthy list.
Reduced exposure windows
New exposures surface in days, not at the next annual assessment.
Compliance evidence on demand
Audit-ready reporting for ISO 27001, PCI DSS Requirement 11, and Cyber Essentials.
Continuous Threat Exposure Management services
Frequently asked questions
Straight answers to what prospective clients ask us most.
What is CTEM and how is it different from vulnerability management?
Vulnerability management scans known assets for known vulnerabilities. CTEM is a broader programme: it continuously discovers what you actually have exposed (including assets you did not know about), assesses it across infrastructure, applications, cloud, brand, and credentials, prioritises what it finds using business context, and validates that findings are real before your team acts. Vulnerability management is one module within Sentry CTEM.
Is Sentry CTEM a replacement for penetration testing?
No. Penetration testing provides expert-led exploitation depth at a point in time; Sentry CTEM provides continuous breadth, prioritisation, and validation between tests. They are complementary: CTEM findings directly inform pentest scoping, and many clients use both.
Can I buy the modules separately?
Yes. Vulnerability management (Sentry CVM), attack surface management (Sentry ASM), domain monitoring, and breach & credential monitoring are each available standalone, and all run on the Sentry platform, so you can start narrow and expand to the full CTEM programme without re-onboarding.
What does the AI enrichment actually do?
Every finding is automatically assessed for confidence (is it likely real?), re-ranked for severity using real-world context (exposure, exploitability, asset role), given a contextual risk narrative specific to your environment, and paired with practical remediation guidance. Findings our verification can prove are marked verified, and false positives it disproves are kept off your list. On Managed, an analyst follows up on the findings that need attention.
Which cloud platforms are supported?
Microsoft Azure, Microsoft 365, Amazon Web Services, Google Cloud Platform, and Oracle Cloud Infrastructure, using read-only API access, no agents or network connectivity to your cloud environment required.
How long does onboarding take?
Typically three to four weeks from contract signature to a full baseline: discovered asset inventory, first scan results across your subscribed domains, and monitoring baselines, with a guided walkthrough in Sentry.
What is attack path analysis?
Attack path analysis correlates findings from across the service into chains showing how an attacker could move from an internet-facing entry point to the assets that matter most to your business, with each step backed by evidence. It produces an attack path diagram and prioritised remediation guidance, including which single fix removes the most risk. This capability is in development and will be introduced to Sentry CTEM subscriptions as it becomes available.
Insights and case studies
Ready to talk about continuous threat exposure management?
Get a fixed-scope quote, usually the same working day.