A Critical Review of Continuous Threat Exposure Management and Zero Trust Security in Cloud–IoT Ecosystems

Abstract

The rise in Cloud–Internet of Things (Cloud–IoT) infrastructure has greatly increased the exposure of organizations to cyber threats, with recent studies showing that over 68% of security breaches have originated from misconfigured cloud resources. Continuous Threat Exposure Management (CTEM) and Zero Trust Security (ZTS) models have been proposed to address these challenges; however, nearly 70% of current implementations are still detection-oriented rather than exposure-predictive. This critical review statistically evaluates current research on CTEM models, Zero Trust frameworks, and artificial intelligence-based cybersecurity solutions in multi-cloud and edge environments. A review of the literature suggests that less than 35% of current solutions have combined dynamic risk scoring with automated access control, while less than 25% of current solutions have allowed real-time adaptive policy enforcement. There is a great need for improvement in predictive threat exposure modelling, autonomous security orchestration, and continuous exposure mitigation in heterogeneous cloud–IoT infrastructures. The review identifies essential research goals in the development of an AI-based adaptive cyber defence framework that is predictive, intelligent, and continuously risk-driven in a Zero-Trust security paradigm.