Multiple Incidents, One Lesson: Exposure Is a Pipeline, Not a Scan

Multiple Incidents, One Lesson. Exposure Is a Pipeline, Not a Scan

Within a single week in October 2026, India’s digital trust fabric alone was tested multiple times with entirely different layers of the stack. One of the incidents touched the personal data of bank customers, the other touched the cryptographic roots that every browser relies on to decide whom to trust. Neither was detected by the organizations that owned the exposure. Both were surfaced by outsiders.

What we now know

As per records available publicly, on 16 October, a threat actor advertised about approximately 3.75 lakh records and 2k+ PDF documents allegedly linked to the bank on a breach forum. On 21 October, the bank filed a disclosure with the regulators, confirming that it “has experienced an incident involving the loss of certain data.” The bank said it had identified circa 3.8k customer records containing personal information within the posted dataset, a preliminary figure, and that it received the first alert mid-October through its threat intelligence provider, CERT-In and the Defence Cyber Agency.

The reported exposed fields include registered mobile numbers, dates of birth, names, email and residential addresses, branch and CIF identifiers and loan-lead metadata. Account numbers, card details, passwords and Aadhaar or PAN numbers were not listed. Crucially, the filing names no cause, no affected system and no vendor. Whether the data left the banks system, a subsidiary or a third-party lead-management provider remains unresolved, and the bank has engaged auditors to find out.

Around the same time, a researcher scanning the common CA database found that eight intermediate certificate authorities from a Certifying Authority carried private keys generated with insufficient randomness. The keys could be recovered from the public certificates in under a second. The company traced the defect to a faulty script used in an April 2025 key ceremony, which generated a second, weaker key set that was mistakenly selected for signing.

CERT-In issued advisory CIAD-2026-0050 on 21 October, updated on 23 October, confirming that no malicious exploitation has been established.

Strip away the specifics and the two incidents are the same failure. An exposure existed (a data store reachable from somewhere it should not have been - a key that was never cryptographically re-validated after the ceremony that produced it). It belonged to nobody in particular. It was invisible to the tools that were supposed to find it, because each tool looked at its own slice. And it was discovered by an outsider, which means every clock that matters, from time to detect to time to notify, started late and started under duress.

This is not a tooling shortage. Large enterprises typically run a vulnerability scanner, an external attack surface tool, a cloud posture product, a CMDB, a certificate manager and a ticketing system.. The shortage is of a shared truth that connects them.

Apply CTEM Program to these incidents:

Continuous Threat Exposure Management program describes five stages: scoping, discovery, prioritization, validation and mobilization. Read as a list of capabilities, it looks like something most organizations already own in pieces. Read as a continuous loop on a single data fabric, it becomes something they do not own: a standing prioritization and validation bench that runs every day, against the whole estate, and tells leadership not only what is exposed but whether the controls bought to protect it are working.

Scoping. The business-critical surface is defined to include third-party lead-management platforms, outsourced KYC processors and every public certificate hierarchy the organization depends on. The banks unanswered question (whose system was it?) is a scoping failure.

Discovery. Assets, identities, data stores, SaaS tenants, vendor connections and certificates are resolved into one graph. A certificate is an asset with an issuer, an expiry, a hosting service and a business owner, not a line in a spreadsheet. The question “which of our services chain to the root certificate?” should have been a query that returns in seconds.

Prioritization. Findings are ranked by attack-path reachability and business consequence rather than CVSS. A misconfigured bucket, an over-permissioned service account and an internet-facing endpoint are each “medium” alone and a direct route to customer KYC data together. The program identifies the choke points where one fix collapses many paths.

Validation. This is the bench. Breach and attack simulation, automated penetration testing and control-efficacy checks prove whether a path is genuinely exploitable and whether the SIEM, EDR, WAF or DLP that supposedly covers it actually applies intended controls. Enrichment with threat intelligence, ownership and data classification removes false urgency. A CA’s own key ceremony should be validated the same way, generate, then independently verify the key against known-weak patterns before it signs anything, which is precisely the maker-checker control CERT-In’s advisory now recommends.

Mobilization. Each validated exposure becomes one unified collaboration workflow, routed to an accountable owner with full context attached, measured against an SLA and re-tested on closure. SOC, vulnerability management, IT and the vendor-risk team work from the same record rather than a bouquet of tools with individual risk scoring and no unified data fabric.

Do we have the right tools? Can CTEM give the answer?

For any organization the most valuable output of a unified CTEM program is not a long findings list. It is the evidence validated and prioritized. Which controls stopped a simulated attack path and which did not? Which asset classes have no coverage at all? Where two products overlap and one can be retired? and Whether the mean time from exposure discovered to exposure closed is actually falling quarter on quarter. That turns security spend from an act of faith into a measured evidence based portfolio.

It also changes the shape of a disclosure. An organization that can say “the exposure was a third-party lead platform, the affected records are these, the path has been closed and re-tested” is a very different conversation with its regulators, its exchanges and its customers.The best time to plant a tree was twenty years ago. The second‑best time is now. The best time to plant a tree was twenty years ago. The second-best time is now.” The same is true of exposure management. Adversaries already use AI to find exposures, craft lures, and chain exploits at machine speed, and a defense built on quarterly scans and annual pen tests cannot keep up. The answer is a Continuous Threat Exposure Management (CTEM) program that runs as a closed loop.

AI agents are embedded at every stage, so the organisation finds, ranks, tests, and fixes exposures faster than an AI-enabled attacker can weaponise them. Like planting that tree, the program is best built deliberately, module by module, with each capability feeding the next.

Stage 1, Scoping. This step defines the crown-jewel business services, the risk appetite, and a financial baseline so that every later finding can be measured in business terms.

Stage 2, Discovery. With scope fixed, the program finds exposures across every layer. Attack Surface Management (both inside-out and outside-in) builds a continuously updated inventory of external and internal assets, domains, APIs, and shadow IT. Cloud Misconfigurations monitoring catches risky IAM policies, open storage, and drift across multi-cloud estates. Unified Vulnerability Management consolidates findings from all scanners into one deduplicated view tied to asset ownership. SCA and SBOM extends discovery into the software supply chain, mapping open-source components and inherited vulnerabilities. Dark Web Monitoring surfaces leaked credentials, data, and chatter targeting the organisation.

Stage 3, Prioritization. Discovery produces volume, prioritization of vulnerabilities, threats and controls turns it into focus. Threat-Informed Defense maps those adversarial TTP’s to MITRE ATT&CK and to the organisation’s control coverage, which shows where defenses are thin against the threats that actually matter. Unified Attack Paths brings this together by modelling how an attacker could chain a leaked credential, a cloud misconfiguration, and an unpatched server into a route to a crown jewel. That lets teams fix the few choke points that break many paths at once.

Stage 4, Validation. Prioritized exposures are proven, not assumed. Breach Attack Simulation safely and continuously emulates real adversary behaviour to confirm whether controls stop it. Seamless Purple Teaming turns those results into a shared loop between red and blue teams, so they test, tune, and retest together. Detection Engineering converts the gaps into new or improved detection rules, written as code and validated against the simulations. Threat Hunting then proactively searches for adversaries who may already be inside, using hypotheses drawn from threat intelligence and attack-path findings. Phishing assessment exposes the human attack surface, which is increasingly targeted with AI-generated lures.

Stage 5, Mobilization. Insight only matters if it drives action. These compresses mean time to remediate from weeks to hours. The CISO Dashboard closes the loop for leadership by reporting exposure trends, control effectiveness, remediation velocity, and quantified risk reduction in board-ready language. Those results feed back into the next scoping cycle.

Building a CTEM program is not a one-time project but a lasting change in how an organisation understands and reduces risk. It replaces the scan-and-patch cycle with a continuous loop that scopes what matters to the business, discovers exposures across every layer of the attack surface, prioritizes the few that adversaries can actually exploit, validates whether defenses hold, and mobilizes teams to fix what counts. The organisations that succeed do not try to do everything at once. They start with a strong foundation in attack surface and vulnerability management, layer in threat-informed prioritization and attack-path analysis, prove their controls through continuous validation and purple teaming, and translate every result into quantified risk that the board can act on. Agentic AI is what makes this loop sustainable at scale: as attackers automate, defenders must too, with autonomous agents that investigate, test, and remediate at machine speed under clear human oversight.

The outcome is a security program measured not by patch counts or alert volumes but by demonstrable reductions in business risk, and one that grows stronger with every cycle.

The best time to plant that tree was twenty years ago. The second-best time is now, and every cycle of a well-built CTEM program makes the roots run deeper.

About the Author: Ishtiyaq Shah is the Principal Solutions Architect at Gambit Cyber. He is a highly respected technology and cybersecurity leader with over two decades of experience across the global security ecosystem.

Disclaimer: The information provided on this blog is intended for general information purpose only and does not constitute legal, financial, medial, or other advice. By using the blog, you hold the author and Gambit Cyber B.V. harmless from all claims, damages, or expenses arising from the use.