Vulnerability Management & Penetration Testing
The Brick House: Operationalizing CTEM — From Exposure to Action
Quotes from The Brick House #59
EVENT SPEAKERS
Learn from Cybersecurity Experts
Gary Brickhouse is the Chief Information Security Officer (CISO) at GuidePoint Security, where he leads the company’s information security program and manages the GRC Services consulting practice. His expertise spans compliance, data privacy and securing technologies, honed through previous roles at The Walt Disney Company and Publix Super Markets. A frequent industry speaker, Gary holds a CISSP certification, ITIL v3 Expert credential and a Bachelor of Science from Florida Southern College.
Victor Wieczorek
Victor Wieczorek leads Offensive Security at GuidePoint Security, overseeing capabilities across penetration testing, application security and other offensive security disciplines. With extensive experience helping organizations understand how attackers operate, Victor brings a real-world perspective on continuous validation, exploitable risk and using offensive security to strengthen broader exposure management programs.
Josh List
Josh List is Director of Vulnerability Management at GuidePoint Security, where his team focuses on the vulnerability management lifecycle. His work includes helping organizations improve how they scope, discover, prioritize and validate exposures, with an emphasis on moving beyond vulnerability volume to provide better risk information and focus remediation on what matters most.
Bobby Brill
Bobby Brill is Sr. Director of DevSecOps at GuidePoint Security, with experience leading security teams and nearly a decade working in cloud environments. He helps organizations connect cloud, application and vulnerability management practices while moving security earlier in the development lifecycle and toward more proactive risk reduction.
Dale Madden
Dale Madden is a Senior Managing Security Consultant at GuidePoint Security with a background in healthcare IT and offensive security. His work focuses on continuous penetration testing and helping organizations evolve from point-in-time assessments toward more continuous approaches to security validation that account for changing environments and emerging risk.
About The Brick House:
Inside the Episode
What is CTEM and is it a product you can buy?
No. CTEM (Continuous Threat Exposure Management) is an operating approach — not a tool. Josh List explained that there’s a common misconception that you can purchase a “CTEM product” and check the box. In reality, CTEM is a framework for finding and fixing the exposures that actually matter by uniting siloed teams, tools and data sources into a continuous, coordinated program. Tools can facilitate CTEM, but no single product delivers it.
How fast can AI-assisted attacks actually move?
Victor Wieczorek shared a real engagement story: a consultant achieved the fastest-ever domain administrator compromise starting from outside the client’s environment. The speed didn’t come from the attacker’s AI tools — it came from the client’s own AI. The consultant logged into the client’s M365 portal, found Copilot and simply asked it where cybersecurity leaders stored their sensitive files. Copilot initially refused, but when the consultant said he was a hired security professional, Copilot handed over the information. Enterprise AI tools create entirely new attack surfaces that most organizations haven’t accounted for.
Why is business context the #1 gap in exposure management?
In the live audience poll, “business context to drive prioritization” was the top answer for where exposure management breaks down most often. Josh List explained that most organizations do a reasonable job layering in exploitability and threat intelligence data, but still struggle to connect findings to what actually drives the business. Bobby Brill recommended tying asset scopes to business processes as the critical last step most organizations skip.
Where does remediation break down and how do you fix it?
Bobby Brill pointed to people and process as the real drivers — not technology. The breakdown happens when security teams throw findings over the fence and say “see you next month.” The fix is security champion programs, cross-functional stakeholders who are invested in outcomes and giving remediation teams access to security tools so they can validate their own fixes. His advice: “Your best friends are those remediation and mobilization teams. Make sure you send them lunch.”
How do you measure ROI on a CTEM program?
Victor reframed the question entirely: it can’t just be an ROI story — it has to be an enrichment story. Traditional metrics like “vulnerabilities closed” are misleading because a maturing program will actually identify more vulnerabilities as visibility improves. The real outcomes are operational: better capacity, faster context-sharing, broken-down silos, improved SLAs and teams that become champions for meaningful risk reduction.
