EUROPEAN EXPOSURE MANAGEMENT MARKET · FUTURE HORIZONS
European Exposure Management Market
Three Horizons foresight · By the Cyberfuturists, made using Aunoo
2026-11-03 09:56:33 · 15 scenarios · 5 executive summary cards · 86 articles
Three Horizons Model
Visualising the transition from current systems (H1) through emerging innovations (H2) to future visions (H3).
Current
Transition
Future
Patch-cycle vulnerability management collapses as exploit windows shrink to hours
Severity-score triage persists despite proof that context matters more
Point-in-time pentests and annual assessments lose credibility as the assurance model
Perimeter-and-inventory security fails against third-party and shadow exposure
Single-scanner products with a dashboard struggle to defend their category
AI-discovered flaws overload triage and strain disclosure and bug-bounty systems
Adversarial exposure validation becomes the default proof layer inside CTEM programmes
Autonomous AI pentesters and agentic exposure tooling go mainstream and dual-use
Autonomous remediation becomes the contested next step, with no clear leader
Agent identity and accountability emerge as a distinct exposure class
Analyst validation and platform bundling reshape the European vendor field
Continuous, validated exposure management becomes the baseline for regulated European firms
A consolidated CTEM market leaves few independent European specialists standing
Defence runs at machine speed through autonomous, bounded agent systems
Ecosystem-level resilience replaces organisation-level security as the unit of defence
2026
Present
2030
Short-term
2034
Mid-term
2038
Long-term
2041
Horizon
HORIZON-ANCHORED VIEW
Executive Summary
Card 1 of 5
THE END OF SCAN-AND-PATCH: SPEED AND CONTEXT BREAK THE OLD TRIAGE MODEL
Most scenarios expect the scan-then-patch rhythm that many European CISOs still run on to keep losing ground, because exploitation now outruns the cycle and severity labels mis-rank what matters. The scenarios cite 72,812 CVEs recorded in 2026 against 48,244 in all of 2025, and vulnerability exploitation as the top initial-access vector at 31%.
Minority view
Several of these scenarios rest on vendor commentary and practitioner opinion, not measured outcomes. Palo Alto's 'speed program' framing is a sales narrative, and scan-and-patch discipline, applied with better context, may remain adequate for many European mid-market firms for longer than the collapse thesis implies.
Primary signal
Severity-score triage and quarterly patch cycles are the weakest link in current European vulnerability management. The coverage supports 'exploitable, reachable and internet-facing' replacing CVSS-style labels as the prioritisation test, and it does not yet support any vendor's claim to have solved it.
Based on scenarios
- H1 Patch-cycle vulnerability management collapses as exploit windows shrink to hours
- H1 Severity-score triage persists despite proof that context matters more
- H2 AI-discovered flaws overload triage and strain disclosure and bug-bounty systems
Decision fork
✔ If exploit windows keep compressing to hours and CVE volume stays near the 2026 pace
→ Risk-based vulnerability management vendors such as Hackuity, Outpost24, Edgescan, Greenbone and Holm Security must show context-aware prioritisation with measured time-to-remediate gains, or buyers will treat them as scanners with a dashboard.
! If the 2026 CVE surge proves a one-off driven by AI-assisted discovery bursts
→ Incumbent scan-and-patch programmes keep their budget share, and US platforms (Tenable, Qualys, Rapid7) defend European accounts through renewals rather than displacement.
Your window
0-6 months
Test every shortlisted vendor on how it ranks findings by reachability and exposure context rather than severity score, and ask for before-and-after remediation timing from named customers.
6-18 months
Shift evaluation criteria in 2027 buying cycles from scan coverage to measured exposure reduction, and publish shortlists on that basis.
Card 2 of 5
FROM ANNUAL ASSURANCE TO CONTINUOUS, VALIDATED EXPOSURE EVIDENCE
Most scenarios expect point-in-time pentests and annual assessments to lose standing as the assurance model, with adversarial exposure validation and continuous testing becoming the proof layer inside CTEM programmes. By the mid-2030s the scenarios expect measured exposure reduction to be the audit currency under NIS2 and DORA.
Minority view
The shift is asserted more than demonstrated. The sources are commentary that calls pentesting obsolete, vendor pitches (Filigran's attack chaining, Forward's 'verified exposure management') and one survey. Regulators have not stated that annual tests are insufficient, so periodic assessment may remain the audit default for years.
Primary signal
Validation is the category to watch. Filigran (Paris) with OpenAEV, along with Ethiack, Validato and Mitigant, are positioned for it, while the Pentera, Cymulate and XM Cyber incumbents hold the US-led benchmark. The coverage supports buyer demand for measured outcomes (the SANS 2026 Exposure Management Survey) but gives no measured validation results from any European vendor.
Based on scenarios
- H1 Point-in-time pentests and annual assessments lose credibility as the assurance model
- H2 Adversarial exposure validation becomes the default proof layer inside CTEM programmes
- H3 Continuous, validated exposure management becomes the baseline for regulated European firms
Decision fork
✔ If NIS2 and DORA supervisors begin asking for continuous, evidence-producing validation
→ European AEV specialists such as Filigran, Ethiack and Validato gain a regulatory buying reason, and crowdsourced platforms Intigriti and YesWeHack gain share from annual pentest budgets.
! If auditors keep accepting annual reports as sufficient evidence
→ Validation stays an upsell for mature teams, European start-ups face longer sales cycles and tighter runway, and the US vendors Pentera, Cymulate and XM Cyber keep the large-enterprise accounts.
Your window
0-6 months
Check what NIS2 and DORA supervisors in the main member states actually ask for as test evidence, and record which validation vendors name production customers and measured results.
6-18 months
Track whether AEV moves from a feature in platform bundles to a standalone European purchase, and judge each vendor's funding runway against that timeline.
Card 3 of 5
ONE SCANNER WITH A DASHBOARD VERSUS THE FULL CTEM LOOP
Most scenarios expect a credible exposure product to be defined as discovery, prioritisation, validation and remediation together, which puts pressure on vendors positioned on a single capability. The coverage also expects commoditised, AI-driven discovery to erode the value of discovery-only products.
Minority view
Depth can beat breadth. A specialist that does one job measurably better, in external attack surface management for example, can survive inside a buyer's mixed stack. The coverage contains no confirmed acquisition and no customer-outcome data showing bundles outperform specialists.
Primary signal
Single-function European vendors face a real category test, but the coverage supports only the direction, not the winners. Detectify's recognition in KuppingerCole's 2026 Leadership Compass on Attack Surface Management shows analyst validation is available to specialists, and it is not evidence of platform-grade completeness.
Based on scenarios
- H1 Single-scanner products with a dashboard struggle to defend their category
- H2 Analyst validation and platform bundling reshape the European vendor field
- H3 A consolidated CTEM market leaves few independent European specialists standing
Decision fork
✔ If buyers insist on one vendor for the whole CTEM loop
→ Mid-sized EASM and scanning vendors (Hadrian, THINGSRECON, Patrowl, Red Sift, Greenbone) face acquisition by Tenable, Qualys, Rapid7, CrowdStrike or Palo Alto, or marginalisation, and sovereignty under NIS2 becomes the main moat for survivors.
! If buyers keep assembling best-of-breed stacks through integrations
→ European specialists keep independent positions, and consolidation stays limited to tuck-ins such as the earlier Outpost24, Darktrace and Snyk deals.
Your window
0-6 months
Classify each tracked European vendor as whole product or single function against the four-stage loop, and flag which have funding runway to extend it.
6-18 months
Watch for the first US-platform acquisition of a European exposure specialist, since no such deal is evidenced in this coverage, and treat it as the confirming signal for the consolidation trajectory.
Card 4 of 5
AGENTIC AI IN EXPOSURE MANAGEMENT: CLAIMS AHEAD OF MEASURED OUTCOMES
Most scenarios expect autonomous pentesting and agentic remediation to spread quickly and cut both ways, with AI agents also becoming a distinct exposure class. The coverage shows rapid adoption of open-source tools (Shannon at 50k stars, sapper-v2), AI agents sold to resolve findings (Maze HQ), and attackers abusing the Cairn AI pen-test tool to compromise hundreds of sites.
Minority view
Practitioners question whether demos translate to production defence, and a practitioner thread asks who is even leading in autonomous remediation. The most sceptical reading is that agentic tooling will stay a discovery and noise-generation story, with remediation remaining human-gated and ticket-based.
Primary signal
Vendor automation and AI claims currently outrun evidence. There are no published measured outcomes for autonomous remediation in this coverage, and the same capability is already being used offensively, so buyers should treat 'AI-driven' claims as unproven until a named customer reports results.
Based on scenarios
- H2 Autonomous AI pentesters and agentic exposure tooling go mainstream and dual-use
- H2 Autonomous remediation becomes the contested next step, with no clear leader
- H2 Agent identity and accountability emerge as a distinct exposure class
- H3 Defence runs at machine speed through autonomous, bounded agent systems
Decision fork
✔ If a vendor publishes verified, production-grade remediation results
→ That vendor, whether Forward, Maze HQ or a European entrant, sets the template for closing the CTEM loop, and bundled platforms gain a measurable advantage over scanners.
! If dual-use abuse and unaccountable agent actions keep making headlines
→ Scope verification, agent identity controls and accountable operators become procurement requirements, and the burden of proof shifts onto vendors selling autonomy.
Your window
0-6 months
Ask every vendor marketing agentic or autonomous features for production metrics: false-positive rate, fixes completed without human intervention and mean time to remediate.
6-18 months
Add agent identity, credential hygiene and scope controls to exposure assessments, given that 76% of enabled AI agents had not run in 60 days yet kept credentials and access.
Card 5 of 5
THIRD-PARTY, SHADOW AND ECOSYSTEM EXPOSURE
Most scenarios expect breaches to keep arriving through vendors and forgotten assets, so perimeter-and-inventory security fails and the unit of defence moves from the single organisation to the ecosystem. Examples include ConnectWise suspending cloud backup after attackers compromised Microsoft 365 tenants, and Palo Alto counting about 22 million exposed PHP instances.
Minority view
Ecosystem resilience is the weakest-evidenced scenario here, resting on an analyst argument about loss growth and calls for shared exercises. Organisation-level controls with disciplined asset inventory and contractual flow-down under NIS2, DORA and the Cyber Resilience Act may be enough without sector-wide joint verification.
Primary signal
Third-party and shadow exposure is where external attack surface management and security ratings vendors have the clearest market argument, and the coverage supports the need but not any vendor's measured effectiveness. Board of Cyber, RiskXchange, Red Sift and Patrowl are positioned on it, and none is shown in this coverage to have reduced customer breach rates.
Based on scenarios
- H1 Perimeter-and-inventory security fails against third-party and shadow exposure
- H3 Ecosystem-level resilience replaces organisation-level security as the unit of defence
- H2 AI-discovered flaws overload triage and strain disclosure and bug-bounty systems
Decision fork
✔ If supply-chain regulation (NIS2, DORA, the Cyber Resilience Act) turns third-party exposure into audited evidence
→ Security ratings and EASM vendors with European data residency gain a sovereignty-based buying reason, and demand grows for continuously verified supplier exposure data.
! If third-party risk stays a questionnaire-and-contract exercise
→ Ratings and EASM stay low-priority line items, and platform vendors absorb the capability as a module without a European specialist premium.
Your window
0-6 months
Separate EASM and ratings vendors that discover and verify supplier assets from those that only score them, and check data-residency and sovereignty claims against actual hosting and ownership.
6-18 months
Track supervisor guidance on supplier exposure evidence under NIS2 and DORA, and watch the funding runway of the smaller European ratings and EASM vendors.
THREE HORIZONS COLUMNS
Detailed Scenarios
Current
Declining Systems
2026-2030
Patch-cycle vulnerability management collapses as exploit windows shrink to hours
The scan-and-patch rhythm that most European CISOs still run on is losing ground: new CVEs are weaponized within hours or before disclosure [4], and 72,812 CVEs have been recorded in 2026 against 48,244 in all of 2025, with vulnerability exploitation already the top initial-access vector at 31% [43]. Palo Alto's CEO says AI attacks are 'a speed program, not a brute force problem' that patch-based defences cannot match [10].
Negative/Disruptive
2026-2031
Severity-score triage persists despite proof that context matters more
Teams still sort by CVSS-style severity even as practitioners argue a medium finding on an internet-facing auth server outranks a high on an isolated test box [2][25]. CISA's October 2026 KEV additions, two dating to 2015, show that known, old flaws stay exploitable because prioritisation by label fails in practice [6].
Negative
2026-2032
Point-in-time pentests and annual assessments lose credibility as the assurance model
Commentary frames point-in-time penetration testing as obsolete next to continuous bug bounty and AI-driven crowd testing [45], and Forbes argues post-breach forensics is no longer enough in supply chain security [50]. Continuous, evidence-producing validation is replacing the annual report on which NIS2 and DORA audit conversations have leaned.
Negative
2026-2031
Perimeter-and-inventory security fails against third-party and shadow exposure
Breaches keep arriving through vendors and forgotten assets: ConnectWise suspended cloud backup after attackers compromised Microsoft 365 tenants [35], and Deloitte notes criminals exploit third-party vendors to reach large organisations [80]. Palo Alto counts about 22 million exposed PHP instances [13], and 76% of enabled AI agents had not run in 60 days yet kept credentials and access [29].
Negative
2026-2032
Single-scanner products with a dashboard struggle to defend their category
Coverage increasingly defines a credible exposure product as discovery plus prioritisation plus validation plus remediation, not detection alone [8][42]. Vendors positioning on one capability face pressure from platforms that bundle the loop, a test Aunoo readers should apply to every European shortlist.
Critical/Neutral
Transition
Emerging Innovations
2027-2033
Adversarial exposure validation becomes the default proof layer inside CTEM programmes
AEV is being marketed as the answer to exploit timelines that outrun assessment [4], and CTEM messaging now pairs attack-surface visibility with adversarial validation [7][48]. Filigran, the Paris-based OpenAEV maintainer, pitches attack chaining as validation logic [79], while the SANS 2026 Exposure Management Survey and Seemplicity's 'validated risk into fixes' framing signal buyers are asking for measured outcomes [67].
Positive
2027-2034
Autonomous AI pentesters and agentic exposure tooling go mainstream and dual-use
Open-source autonomous pentesters such as Shannon (50k stars) and sapper-v2 are spreading fast [3][63], and Maze HQ is selling AI agents that investigate and resolve vulnerability findings [39]. The same capability cuts both ways: hackers abused the Cairn AI pen-test tool to compromise hundreds of sites [33], and practitioners question whether demos translate to production defence [46].
Mixed
2027-2035
Autonomous remediation becomes the contested next step, with no clear leader
A practitioner asks who is leading in autonomous exposure remediation and describes teams unable to agree whether fixes are tickets, pull requests or WAF rules [47]. Forward's 'verified exposure management' pitch [49] and CTEM commentary stressing remediation that breaks attack paths [8][48] show vendors converging on closing the loop, with no measured outcomes yet to separate claims from results.
Mixed
2026-2032
AI-discovered flaws overload triage and strain disclosure and bug-bounty systems
An AI-assisted discovery in PHP, potentially affecting 70% of websites, forced governments and corporations into emergency patching [30], and Anthropic's deputy CISO warns of roughly 18 months of heightened pressure on CISOs [24]. Meanwhile curl closed its bug bounty over non-reproducing AI-written reports [77], showing discovery outpacing triage, a bottleneck European crowdsourced platforms such as YesWeHack and Intigriti must manage [57].
Disruption/Warning
2027-2034
Agent identity and accountability emerge as a distinct exposure class
CERT-In flagged autonomous AI agents accessing live systems of Indian organisations, none of which detected the intrusions [49][81], while a Railway employee was accused of probing another company's infrastructure with automated tools, prompting 'you are responsible for what it does' [1]. Boards are urged to tighten AI and identity oversight [16], and unbounded signing authority on bots is flagged as a loss route [73].
Warning/Disruption
2027-2033
Analyst validation and platform bundling reshape the European vendor field
EASM vendors are earning analyst recognition, such as Detectify in KuppingerCole's 2026 Leadership Compass on Attack Surface Management [55], while US platforms and AI-native entrants (Sequretek, Maze HQ) push integrated CTEM [7][39]. The coverage here contains no confirmed acquisition, so whether US vendors absorb the European specialists remains an open question, not a finding.
Mixed
Future
Emerging Vision
2034-2040
Continuous, validated exposure management becomes the baseline for regulated European firms
A mature CTEM loop of discovery, context-aware prioritisation, adversarial validation and verified remediation [8][25][48] becomes the evidence regulators and boards expect, with the 'exploitable and reachable' test replacing severity labels. NIS2 and DORA make measured exposure reduction, not scan counts, the audit currency.
Positive
2035-2041
Defence runs at machine speed through autonomous, bounded agent systems
Attack and defence both shift to agents operating in minutes [5][47], so exposure shrinking becomes autonomous but scope-limited, with pre-flight scope verification and accountable operators [1][86]. Pre-attack prevention that plugs the gaps attackers target replaces post-breach response as the primary posture [42].
Breakthrough
2036-2041
Ecosystem-level resilience replaces organisation-level security as the unit of defence
Analysts argue cyber losses have grown from tens of millions to trillions over two decades and that ecosystem risk and capacity gaps will define the next decade, so one secure organisation is not enough [17]. Shared exercise criteria between government and industry [9] and third-party risk programmes [18] point towards sector-wide, jointly verified exposure management.
Trend/Evolution
2034-2040
A consolidated CTEM market leaves few independent European specialists standing
If platform bundling [7][42] and AI-driven commoditisation of discovery [3][54] continue, mid-sized single-function vendors face acquisition or marginalisation, and sovereignty-driven demand under NIS2 becomes the main moat for survivors. The current coverage does not evidence a specific deal, so this is a trajectory to monitor, not a confirmed outcome.
Mixed
SOURCE CORPUS
Article References
🤖 Contains AI-generated content produced by Aunoo. Verify against cited sources before external use.
By the Cyberfuturists
made using AunooEuropean Exposure Management Market · Three horizons · About · Privacy · Consensus analysis