Validation is the fourth stage of Continuous Threat Exposure Management (CTEM), where teams prove which prioritized exposures are actually exploitable and reachable in their environment. Instead of relying on severity scores alone, validation tests exploitability, shows how an attack could unfold, and checks whether existing security controls would detect, prevent, or contain it.

In TrollEye, validation sits between Prioritization and Mobilization, so the exposures that move into remediation carry evidence, not assumptions.

A scanner identifies potential weaknesses. Validation confirms which of those weaknesses can actually be exploited.

A scan reports that a vulnerable version or misconfiguration exists. Validation tests whether an attacker could reach and exploit that exposure under real-world conditions, what access it would provide, and whether your controls would stop it. The result is a smaller set of evidence-backed exposures instead of a longer list of findings.

Prioritization ranks exposures by likely risk. Validation proves whether that risk is real.

Prioritization uses business context, asset criticality, threat intelligence, and exploitability signals to decide what deserves attention first. Validation then tests those high-priority exposures to confirm exploitability and reachability, so teams are not committing remediation resources based on scoring alone.

No. In CTEM, validation proves whether an exposure is exploitable and reachable before remediation. It does not confirm that a fix worked afterward.

Confirming that an exposure has been closed happens through retesting as part of Mobilization and ongoing measurement. Keeping the two separate matters: validation decides what deserves action, and mobilization makes sure that action actually reduced risk.

TrollEye validates exposures across infrastructure, applications, identities, people, and security controls:

Infrastructure: exploitability across servers, cloud, and externally exposed assets.
Applications and APIs: vulnerabilities confirmed through real-world testing.
Identities: compromised credentials and dark web activity.
People: phishing and social engineering exercises.
Controls: detection and prevention tested against realistic attack scenarios.

Yes. Penetration testing is one of the most direct ways to prove exploitability. TrollEye delivers it as Penetration Testing as a Service (PTaaS), combining agentic and human testing.

That pairing lets validation scale across the attack surface while experienced testers pursue chained attack paths and business logic issues. Results feed back into the CTEM platform with the evidence remediation teams need to act.

Breach and Attack Simulation (BAS) validates your defenses rather than individual vulnerabilities. It runs realistic attack techniques against your environment to show whether security controls detect, block, or contain them.

Paired with Managed SIEM and Purple Team engagements, BAS reveals detection blind spots so teams can tune controls based on how attacks actually behave, not just how tools are configured.

Continuously. Environments change constantly as assets are deployed, code ships, configurations drift, and new exploits are published, so a point-in-time test goes stale quickly.

In a CTEM program, validation should keep pace with discovery and prioritization, so the evidence behind remediation decisions reflects the environment as it is today, not as it was during last year's assessment.

Yes. By separating exposures with confirmed exploitability from lower-value noise, validation helps security and engineering teams spend less time on findings that pose little real-world risk and more time on the exposures that do.

It also gives system owners concrete evidence, which cuts down the back-and-forth over whether a finding is worth fixing.

Validated exposures move into Mobilization, the fifth stage of CTEM, along with the evidence teams need to act: how the exposure can be exploited, what it could lead to, and which controls did or did not respond.

From there, TrollEye supports ownership, remediation initiatives, and retesting so teams can confirm that risk actually went down.

Not necessarily. TrollEye is a platform backed by services, and the two are designed to work together. The CTEM platform adds validation evidence and context to exposures, while services such as PTaaS, Breach and Attack Simulation, social engineering assessments, and Purple Team engagements add depth where hands-on testing matters most.

Automated CTEM plans start at $995 per month, and eligible packages include a 14-day free trial.