Exposure inventory
Internet-facing and internal assets, owners, and the unknowns still to resolve.
Who uses itSecurity operations, IT owners
Solution 1 of 6
Manage Cyber Risk & Exposure
Find what an attacker could reach, rank it by what it would cost the business, and fix the right things first.
- 01Discover
- 02Contextualize
- 03Prioritize
- 31%of breaches began with an exploited vulnerability. It is now the most common way in. A year earlier it was 20%.Verizon DBIR 2026
- 26%of known-exploited vulnerabilities were fully fixed in 2025, down from 38%. The median fix took 43 days.Verizon DBIR 2026
- −7 daysestimated mean time to exploit. Attackers often act before a patch exists.Mandiant M-Trends 2026
- $4.99Mglobal average cost of a data breach, up 12% on the year before.IBM Cost of a Data Breach 2026
The problem
A longer list does not mean lower risk.
In 2025, 46,407 vulnerabilities were published, up from 40,009 in 2024. Few of them matter to any one organization. Cyentia’s study of 237,687 CVEs found that about 6% were ever seen exploited in the wild. CISA added 245 to its Known Exploited Vulnerabilities catalog in 2025.
Most remediation queues are still sorted by severity score and scanner output. That sorts by how bad a flaw could be in general. It does not say whether anyone is using it, or whether an attacker can reach it in your environment.
Verizon’s 2026 data show the cost of that gap. The flaws that attackers are known to use are getting fixed more slowly, not faster.
From published to exploited, 2025
- 46,407Vulnerabilities published, 2025Up from 40,009 in 2024
- 883Newly seen exploited in the wild, 2025About 1.9% of those published
- 245Added to CISA’s Known Exploited Vulnerabilities catalog, 2025About 0.5% of those published
Publication counts and exploitation counts, as compiled by Zafran from VulnCheck KEV and CISA KEV.
- 20% → 31%Breaches that began with an exploited vulnerability2025 report to 2026 report
- 38% → 26%Known-exploited vulnerabilities fully remediatedPrior year to 2025
How it works
How the work runs, step by step.
1,284assets found
212internet-facing
37with no owner
| Asset | Type | Exposure | Owner | Last seen |
|---|---|---|---|---|
| Customer portal | Web app | Internet | Retail IT | Today |
| Payments gateway | API | Internet | Payments | Today |
| Build server | Server | Internal | No owner | 2 days ago |
| Old marketing site | Web app | Internet | No owner | Unknown |
| Finance database | Database | Internal | Finance IT | Today |
| Partner VPN | Network | Internet | Network team | Today |
| Test cloud account | Cloud | Internet | No owner | 5 days ago |
We look at your organization from the outside, the way an attacker does, then compare that with what your teams believe they have. Internet-facing systems, cloud accounts, identities, third-party connections and forgotten assets all count.
- We work from
- External scan data, cloud and identity inventories, scanner and asset records, interviews with asset owners.
- You get
- One asset and exposure inventory, with an owner against each item and a short list of unknowns.
Route 1 of 3Reaches payments data
4 steps. One control missing.
Fix firstWe connect each exposure to what an attacker could reach from it: identities, network paths, cloud permissions, the business services behind them. We check which controls already break the route.
- We work from
- The inventory, architecture and identity data, existing control coverage, the business services and data that matter most.
- You get
- An attack-path map from entry points to critical systems, with the points where a fix or control cuts the route.
ActionExposure removedOwnerEffort
- 1Close admin access to the build server38%Platform teamLow
- 2Remove the unused test cloud account24%Cloud teamLow
- 3Enforce MFA on the partner VPN17%Network teamMedium
- 4Patch the payments gateway library12%PaymentsMedium
- 5Retire the old marketing site6%MarketingLow
- 6Segment the finance database3%Finance ITHigh
We rank by evidence: confirmed exploitation, likelihood, reach, control gaps and the cost of the fix. We size the top scenarios as ranges, with assumptions stated, and set owners and dates.
- We work from
- The attack-path map, exploitation intelligence, business impact estimates, remediation capacity.
- You get
- A ranked fix plan, risk scenarios the business can compare, and a small set of measures tied to decisions.
Where this starts
Start with the question you are stuck on.
Choose a question4 questions · select any
- Where we would start
- We map findings to the routes an attacker could actually use, then rank each route by what it reaches.
- Who works on it
- Exposure and attack-path practitioners, led by a senior consultant.
- What you hold at the end
- A ranked fix list tied to business systems, with the reasoning written down.
- Where we would start
- We agree the few scenarios that matter most and size them as ranges, with the assumptions stated.
- Who works on it
- Cyber risk specialists who have briefed boards.
- What you hold at the end
- A risk view the board can set beside its other business risks.
- Where we would start
- We look at your organization from the outside and list every internet-facing asset, including ones no team owns.
- Who works on it
- Attack surface and threat intelligence practitioners.
- What you hold at the end
- An asset list with owners, and a short list of the unknowns to chase.
- Where we would start
- We choose a small set of measures that show change in exposure, not security-team activity.
- Who works on it
- A senior security leader and a risk specialist.
- What you hold at the end
- A report that shows direction of travel, with each measure tied to a decision.
What you hold
What you can use the week we finish.
- Ransomware on payments
- Customer data theft via a partner
- Cloud account takeover
- Build pipeline compromise
$0$5M$10M$15M$20M
Bar = 10th to 90th percentile of one-year loss. Tick = median. Assumptions come with the pack.
Known-exploited flaws open over 30 days
12from 41
Routes to payments data
1from 3
Assets with no owner
9from 37
Attack-path map
Routes from entry points to critical systems, and where each can be cut.
Who uses itSecurity leaders, architects
Ranked fix plan
The top actions with owner, effort and the exposure each one removes.
Who uses itIT and engineering leads
Risk scenarios
The few scenarios that matter, sized as ranges with assumptions written down.
Who uses itCFO, risk committee, board
Measures
A short set of measures tied to decisions, such as how long known-exploited flaws stay open.
Who uses itCISO, board
A different way to look
The same estate, two ways to look at it.
12,480open findings
1,912critical
4,306high
| Finding | Severity | Age | Owner |
|---|---|---|---|
| CVE finding on host 10.2.4.17 | High | 212 d | Unassigned |
| Missing HTTP security headers | Medium | 340 d | Unassigned |
| Outdated TLS configuration | Medium | 298 d | Unassigned |
| Remote code execution, library | Critical | 97 d | Unassigned |
| Directory listing enabled | Low | 410 d | Unassigned |
| Weak cipher suite accepted | Medium | 260 d | Unassigned |
| Cross-site scripting, reflected | High | 144 d | Unassigned |
| Self-signed certificate | Low | 501 d | Unassigned |
| SQL injection, login form | Critical | 61 d | Unassigned |
| Banner discloses version | Low | 388 d | Unassigned |
12,470 more
- Unit of work
- A finding
- How it is ranked
- Severity score
- Who owns the fix
- The security team, by ticket
- What gets reported
- Count of open items
- OpenEmployee login to build server to payments data1 control missing
- ClosedPartner VPN to finance network to payments dataCut at the VPN
- ClosedTest cloud account to payments dataAccount removed
- Fix firstRoute 1. One control closes it.
- Unit of work
- A route an attacker can take
- How it is ranked
- Exploitation evidence, reach, control gaps, business impact
- Who owns the fix
- A named owner of the affected asset
- What gets reported
- Routes closed, and time known-exploited flaws stay open
What the board hears
We have 12,000 open findings.→
Three routes reach payments. Two are closed.
Common mistakes
Beliefs worth dropping.
“Critical means urgent.”
A severity score describes how bad a flaw could be in general. It does not say whether attackers are using it, or whether it is reachable in your environment. Confirmed exploitation, such as CISA’s catalog, and exploit likelihood, such as the EPSS score, are separate signals. No single score covers all of them, plus context.
“We need to patch faster.”
Speed helps, but volume cannot be won. Verizon found a median of 43 days to fully fix known-exploited flaws, and only 26% fully fixed. The better question is which few to fix this week, and which routes a control can cut without a patch.
“Our scanner covers our assets.”
A scanner sees only what it is pointed at. Exploits were the most common way in for the sixth year running in Mandiant’s casework, at 32% of intrusions. The assets that get used are often the ones no list contains.
Regional view
What it costs in the Middle East.
IBM’s 2025 study put the average breach in the Middle East at $7.29 million, among the highest of the regions it reported and well above the 2025 global average of $4.44 million. IBM’s 2026 edition reports a global average of $4.99 million. Sector rules differ across the region, so the same exposure can carry different consequences for a bank, a hospital and an airline.
- Middle East, 2025$7.29M
- Global, 2026$4.99M
- Global, 2025$4.44M
Average cost of a data breach. IBM and Ponemon Institute studies. Years differ by row.
Standards we work from
- NIST Cybersecurity Framework 2.0Our common language for Identify and Govern: asset management, risk assessment and improvement.
- ISO/IEC 27005The information security risk management guidance we map scenarios and treatment decisions to.
- FAIR (The Open Group)A method for sizing scenarios as ranges of loss. We use it where a number helps a decision, not by default.
Using a standard as a common language is not certification or endorsement.
Where our specialists come in
Specialist work, placed along the lifecycle.
Your problem decides which of these we use. You do not have to pick.
- Govern
- Identify
- Protect
- Detect
- Respond
- Recover
- Comply
- Evolve
Govern
Direction and accountability
- Cyber Risk & Governance
- Board & Executive Advisory
Identify
Know your exposure
- Cyber Risk Assessments
- External Attack Surface Management
- Vulnerability & Exposure Management
- Threat & Attack Path Analysis
- Crown Jewel Identification
- Security Maturity Assessments
- Identity Security Posture Management (ISPM)
Read first
What our practitioners have written on this.
Article
Why Cybersecurity Programs Keep Growing Without Reducing Business Risk
Security spend grows because activity is easy to add and hard to retire. Risk falls only when a change reduces the likelihood or impact of a specific loss.
Cybrilliant Risk Management SME
Read →Technical Explainer
What Attackers Can See From the Internet
Your attack surface is whatever an outsider can find, reach and test. Here is how to see it the way they do.
Cybrilliant Exposure Management SME
Read →Technical Explainer
Attack Path Analysis Explained
How the method works, what data it needs, how to read the results, and where it can mislead you.
Cybrilliant Threat Intelligence SME
Read →Research / Report
Research: The Enterprise Cyber Risk Prioritization Model
A model that ranks risk by what an attacker can reach, what is being exploited and what the business would lose, built on published data and open about where it stops.
Cybrilliant Risk Management SME
Read →Practitioner Field Note
Field Note: What a Good Cyber Risk Workshop Should Produce
A workshop earns its calendar time when it ends with ranked risks, named owners and decisions the business can act on.
Cybrilliant Risk Management SME
Read →Expert Briefing
Expert Briefing: From Cyber Activity to Business Risk
A briefing on turning security activity into measures and decisions that boards and executives can act on.
Cybrilliant Risk Management SME
Read →Questions
What people ask before they start.
How is exposure management different from vulnerability management?
Vulnerability management finds and tracks flaws. Exposure management asks a wider question: which weaknesses, anywhere in the estate, give an attacker a route to something that matters. It adds assets that scanners miss, identity and cloud paths, and the controls already in the way.
Where does the work start?
With the question you are stuck on. We first agree the scope, the systems and the decisions that matter most. Then we look from the outside in, and compare that with what your teams believe they have.
Do we need to buy new tools?
Not as a starting condition. We work from the data and tools you already run where we can. If a gap needs a tool, we say so and agree it with you first.
What will our board see?
A short view built for decisions: the few routes that matter, what each would cost as a range, what is being fixed and by whom, and a handful of measures that show direction over time.
Do you work with our existing security team and providers?
Yes. Fixes are owned by the people who run the systems. We bring the analysis and the ranking, and stay involved through the fix.
Sources and notes
- Verizon, 2026 Data Breach Investigations Report: Executive Summary
- Infosecurity Magazine, coverage of the Verizon 2025 DBIR
- Google Cloud / Mandiant, M-Trends 2026
- IBM, Cost of a Data Breach Report 2026
- Morgan Lewis, summary of IBM Cost of a Data Breach 2025
- Cyentia Institute, A Visual Exploration of Exploitation in the Wild (EPSS)
- Zafran, The 2025 spike in vulnerabilities isn’t the full story