Scoping within the Continuous Threat Exposure Management (CTEM) cycle entails a meticulous examination of the infrastructure segments to be encompassed in the process. It necessitates a thorough comprehension of the organization’s business aspects to establish an appropriate scope for the CTEM initiative. For a pilot CTEM program, an ideal scope might involve scrutinizing the external attack surface and the security posture of Software as a Service (SaaS) systems. The process initiates with an exhaustive discovery phase, which entails assessing the entire attack surface—externally, internally, and within the cloud. As the CTEM cycle advances, refining the scope becomes imperative. This stage underscores the importance of precise metrics, which should encompass network segment specifics, security control data, identified threat categories, threat tactics and techniques, quantified risk factors, and overall cyber resilience metrics. These metrics, originating from the initial scoping phase, serve as a basis for aligning the refined scope with the organization’s strategic cybersecurity objectives.