Exposure Management
Exposure Management
Exposure Management tests the continuous lifecycle of finding, understanding, and reducing the ways an attacker could reach something valuable: discover assets, normalize them, score the exposure, prioritize, remediate, and verify. The exam stresses prioritization judgment over scan output volume.
Core rules
- An exposure is a condition an attacker can use - an internet-facing service, a weak credential, a missing control, a misconfiguration - not just a CVE with a score attached.
- Inventory must include unmanaged and shadow assets, cloud workloads, and OT/IoT. Deduplication matters because one host seen by three scanners is still one asset.
- CVSS is a severity input, not a priority. Priority combines exploitability (EPSS, known-exploited lists), reachability from an attacker's position, business criticality, and compensating controls.
- Attack-path analysis chains individually minor findings into a route to a crown-jewel asset, and that chain is often the real finding.
- Remediation needs an owner, a due date, and verification. An exception without an expiry is a permanent hole.
- Asset criticality tags go stale; a host that was a test box last quarter may now hold production data.
Worked example
Two findings compete for attention: a CVSS 9.8 flaw on an internal developer host with no route from the internet, and a CVSS 6.5 flaw on an internet-facing VPN concentrator that appears on a known-exploited list. The second is the priority. Reasoning: severity describes the flaw in isolation, while priority describes risk now. The VPN is reachable, exploited in the wild, and likely a path into the estate. The developer host may still need patching, but it is not the first move.
Traps
- Ranking purely by CVSS or by scanner finding count.
- Ignoring compensating controls, which lower real risk even when the base score does not move.
- Treating a point-in-time scan as continuous exposure management.
- Closing a ticket without re-testing; the exposure may persist on a different asset.
- Confusing compliance findings with exploitable exposure.