From Asset Inventory to Attack Exposure

A complete asset inventory will not tell you where you are exposed. It tells you what exists. Exposure is the harder question: which of those assets an attacker can reach, which weaknesses they can use once there, and what that access opens up.

The inventory question is not the attacker’s question

Most vulnerability programs start from the asset list because it is the one part that feels finite. Scan everything, reconcile against the CMDB, close the gaps, and the program is “covered”. The trouble is what the list can answer. It can say how many servers, endpoints and cloud accounts exist. It cannot say which sit one hop from the internet, which share credentials with a domain controller, or which would let an intruder reach customer data. A flat list ranks nothing.

Attackers work the other way round. They start from what they can reach and look for a weakness that works. Recent investigation data points the same way. In the 2026 Verizon DBIR, which covers incidents from Nov 01, 2024 to Oct 31, 2025, vulnerability exploitation was the initial access route in 31% of breaches. That is up from 20% a year earlier, and ahead of credential abuse at 13%. Mandiant’s M-Trends 2026, drawn from its own 2025 investigations, found exploits behind 32% of intrusions, the most common vector for the sixth year running. The two reports use different data and methods, and they land in the same place.

Neither figure says exploitation is the only way in. Mandiant also reports voice phishing behind 11% of intrusions and prior compromise behind 10%. But for a team deciding what to fix first, the exploited-weakness route is the one a vulnerability program can directly influence.

What exposure adds

Exposure is easier to manage once it has a definition. What follows is a working definition, not a standard: an exposure exists when four conditions hold at the same time.

Remove any one condition and the priority drops. A critical flaw on a host nothing can reach is a maintenance task. A modest flaw on an internet-facing gateway tied to your identity provider is a likely route in.

The edge shows the gap most clearly

Firewalls, VPN concentrators, routers and SD-WAN controllers meet all four conditions more often than most assets. They are reachable by design, they run with high privilege, and they often sit outside endpoint detection. Mandiant says the clusters it tracks as UNC6201 and UNC5807 target VPNs and routers because those devices typically lack standard EDR telemetry. It also reports that BRICKSTORM intrusions ran for nearly 400 days, set against a common 90-day log retention window. A 90-day window cannot reconstruct an intrusion that old.

Speed adds to the problem. Mandiant estimates the mean time to exploit was -7 days in 2025: on average, exploitation began a week before a patch existed. Treat the figure with care. It is an estimate built from vulnerabilities that were exploited, not a typical patch window. The point survives the caveat. For the vulnerabilities attackers want most, a normal patch cycle may arrive too late, so mitigation has to be ready before the fix is.

Governments have begun to say this formally. In February 2026 CISA issued Binding Operational Directive 26-02. As reported, it requires federal civilian agencies to identify unsupported edge devices within three months, begin removing them within a year and eliminate them within 18 months. A directive that starts with “find them” suggests inventory gaps even where governance is mature. That reading is interpretation, but a reasonable one.

Five changes that move a program from inventory to exposure

1. Make the exposure the unit of work, not the asset or the CVE. A line item should read as a route: this gateway, this weakness, this reachable identity, this business system. A finding that cannot be written that way is a candidate for routine patching, not escalation.

2. Scope inventory effort by reachability. Demand near-complete visibility of internet-facing, remote-access, cloud control plane and identity assets. Accept lower fidelity on isolated internal systems. A perfect list of printers helps less than a complete list of gateways.

3. Attach exploitation evidence to every finding. CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalog only with a CVE ID, reliable evidence of active exploitation and a clear remediation, and recommends that organizations outside government use it as a prioritization input. EPSS adds a probability of exploitation activity in the next 30 days. Neither is complete. A NIST paper counted 1,228 KEV entries against roughly 260,000 CVEs in December 2024, about 0.5%, so absence from KEV is not evidence of safety. Add vendor advisories and your own telemetry.

4. Check that exploitation would be visible. For each exposed asset class, confirm that logs leave the device, that retention exceeds realistic dwell time, and that someone owns the alert. An exposure you cannot observe should rank above an identical one you can.

5. Give every exposure an owner and a clock. The owner can patch, mitigate or accept. Acceptance carries an expiry date. Exposures without owners are how findings become permanent.

A hypothetical example

This is a constructed scenario, not a documented incident. A scan returns two findings. Finding A is a critical-rated flaw (CVSS base 9.8) on an internal print server with no route from the internet and no privileged credentials. Finding B is a high-rated flaw (base 8.1) on a remote-access gateway. Exploitation of that flaw has been reported in the wild, the gateway terminates employee VPN sessions, and its logs stay on the device for 30 days.

Ranked by inventory and base score, A comes first. Ranked by exposure, B comes first, and it probably should have been an emergency change last week.

What this means for security leaders

Three decisions follow. Fund discovery of internet-facing and identity-adjacent assets before funding a deeper internal CMDB. Change what the vulnerability program reports, from findings closed to exposures removed. And match the review rhythm to how fast reachability changes. A new deployment or a firewall rule change can alter it overnight, so a quarterly snapshot will miss it.

Exposure analysis has limits. It depends on data many organizations lack: accurate network paths, identity relationships, reliable business criticality. Early versions will be incomplete, and attack-path tooling infers routes rather than proving them. Start with the internet-facing set, where the data is hardest to argue with, and widen from there.

Sources

• Verizon, 2026 Data Breach Investigations Report (dataset Nov 01, 2024 to Oct 31, 2025).

• Google Cloud / Mandiant, M-Trends 2026 (published Mar 23, 2026; calendar 2025 investigations).

• CISA, Known Exploited Vulnerabilities Catalog (inclusion criteria; recommendation to non-federal organizations).

• FIRST, Exploit Prediction Scoring System (EPSS) model.

• NIST CSWP 41, Likely Exploited Vulnerabilities (May 19, 2025) (KEV coverage figures).

• Nextgov, CISA orders agencies to patch and replace end-of-life devices (Feb 05, 2026) (reporting on BOD 26-02).