Threat Exposure Risk: technical risk multiplied by business risk
Contents
A CVSS 10.0 vulnerability on a private test box and a CVSS 6.0 vulnerability on the production system holding customer data are not the same problem, and the second one is closer to real harm. Technical severity and business consequence are different measurements.
Threat Exposure Risk (TER) crosses those two on a single table and lands every finding in one of five bands, S through D.
TER is a band produced by crossing technical rank with asset weight
A three-by-three table decides it: Threat Discovery Level (TDL) down the side, Business Impact (BI) across the top. The heaviest band, S, is reached only by the top two TDL ranks sitting on an asset whose BI is Important.
Figure 1: Technical rank down the side, asset weight across the top
Deep dive: info-level findings carry no band
Anything a scanner reports as info skips the table and keeps an empty band. It falls out of prioritization, so no deadline attaches to it. It is also left out of the band counts, which means a flood of info-level findings never moves the distribution.
The band also sets the deadline, counted from the day of discovery
Each of S through D carries a number of days, and the clock starts the day the finding was first seen.
Figure 2: Days per band, counted from first discovery
Deep dive: move the band and the deadline moves with it
Because the deadline hangs off the band, changing an asset's BI to Important on the grouping screen shortens the deadline on the same vulnerability. Nobody edits a date by hand.
The TER map is those same two axes drawn as a scatter plot
Knowing how the table works still doesn't tell you how much has piled up, or where. Plotting the same two axes and placing one dot per finding is what the TER map does.
Figure 3: The TER map (BI across, effective TDL up)
Deep dive: where the dots gather changes the reading
A cluster in the top right means serious threats on important assets, and the place to start is obvious. Dots spread thinly across the plot call for broad, systematic work instead. A concentration in the bottom left reads as only light findings left.
Hovering a dot shows that finding's CVE, target FQDN, BI, effective TDL, band and owning group. You read the shape of the whole first, then drop straight to one finding.
Of CTEM's five stages, TER covers prioritization
Scope it, discover it, order it, verify it, mobilize. TER is the third of those, taking what the earlier stages gathered and producing only the order.
Figure 4: TER carries the third stage
Deep dive: the earlier stages move the band
The importance of each asset — an initial value judged by AI, then confirmed or changed on the grouping screen — becomes the BI, and the CVSS and EPSS values collected during discovery become the TDL. A band is never fixed once set; it is redrawn every time the loop comes round. What is CTEM? covers the whole cycle.
Engineering and the business end up discussing risk in one vocabulary
Band counts and a week-on-week delta carry the situation without a single piece of jargon. "Three S findings, all concentrated on the core storefront" tells the person receiving the report where to act.
Figure 5: The three numbers a report needs
- What is the Threat Discovery Level (TDL)?
- Severity alone does not decide it: how business impact shapes remediation priority
- CVSS, EPSS, and KEV: Reading the Three Vulnerability Scores
- What is CTEM? How it differs from traditional vulnerability management
Seeing which band your own findings land in is part of the paid plan.
Appendix: the bands, and the axes of the map
Table 1: TER bands and deadlines
| Band | Deadline (from discovery) | Typically |
|---|---|---|
| S | 7 days | Top two TDL ranks on an asset whose BI is Important |
| A | 14 days | Mid TDL on Important BI, or top TDL on Standard BI |
| B | 21 days | Top TDL on Limited BI, mid TDL on Standard BI, TDL1 on Important BI |
| C | 28 days | Mid TDL on Limited BI, or TDL1 on Standard BI |
| D | 35 days | TDL1 on Limited BI |
| (none) | No deadline | Info-level findings |
Table 2: the table that turns TDL and BI into a band
| TDL ＼ BI | Limited | Standard | Important |
|---|---|---|---|
| TDL5 / TDL4 | B | A | S |
| TDL3 / TDL2 | C | B | A |
| TDL1 | D | C | B |
Table 3: the axes of the TER map
| Axis | Meaning |
|---|---|
| Horizontal | BI (further right means a more important asset) |
| Vertical | Effective TDL (TDL1–TDL5; higher means more severe) |
| Colour | TER band (S/A/B/C/D, chosen for colour-vision accessibility) |
How TDL is derived is covered in What is the Threat Discovery Level (TDL)?, and how BI is derived in Severity alone does not decide it: how business impact shapes remediation priority.
The values in this post were checked against PentaTrail's own routines (asm_get_band and asm_finding_sla_days) on 2026-08-17.
Visualize your attack surface with PentaTrail CTEM/ASM
From discovery to remediation — all powered by the CTEM framework.
