openctem.io | Documentation | Get started
OpenCTEM runs the whole CTEM loop in one self-hostable platform: scope what matters, discover your attack surface, prioritise by real exploitability, validate with retests and pentest campaigns, and mobilise fixes until they are verified closed. It never auto-closes a finding without evidence, signs every job it sends to a sensor, and keeps each tenant's data isolated.
| Scope | Discover | Prioritise | Validate | Mobilise |
|---|---|---|---|---|
| Assets, owners, scope rules and approvals | EASM, cloud, code and network inventory | KEV, EPSS, reachability, attack paths | Retests, pentest campaigns, evidence | Grouped fixes, two-way tickets, verified close |
| Repository | What it is | |
|---|---|---|
| Platform | openctem | Go API and Next.js web console, all-in-one image |
| Sensors | sensor | Scanner runtime that runs close to your assets |
| sdk-go | Go SDK, sensor kit and scanner integrations | |
| connector-tenable | Tenable Security Center connector | |
| ci | CI/CD scanner images and pipeline integrations | |
| Data | ctis | CTEM Interchange Schema 2.0: the open format for assets, findings and SBOMs, with SARIF, CycloneDX, SPDX, CSAF, OpenVEX and OCSF adapters |
| contract | Platform-sensor contracts: capabilities, tool settings, transfer bundles | |
| vulnfeed | Signed, normalised vulnerability feed | |
| programfeed | Signed feed of public disclosure programs | |
| sast-rules | Tested, signed SAST rules | |
| Deploy | helm-charts | Helm charts for Kubernetes |
| openctem-ansible | Hardened single-VM install with Ansible | |
| Docs | docs | Source of docs.openctem.io |
Issues and pull requests are welcome. Read the contributing guide in each repository; contributions are made under the Contributor License Agreement.
Report vulnerabilities privately to security@openctem.io or through GitHub private vulnerability reporting. Never open a public issue for a security report. See the security policy.
