Exposures and evidence
A finding is one problem on one asset as one source saw it. An exposure is the weakness itself: one weakness on one asset, however many sources saw it. A network scan, an endpoint agent, an endpoint security vendor and a tester's finding can all describe the same hole in the same server; the CyberOptix CTEM Platform places all of them under one exposure, and it is the exposure that attack paths and the Risk Posture figures are built from.
What belongs to an exposure
Each detection the platform holds becomes a member of exactly one exposure, decided by what it detected and where:
- the asset it was found on;
- the weakness: the set of vulnerabilities for a Scanner detection, the check and its location for a configuration finding, or the catalog entry for a manual finding.
An agent's detection on a host counts on the host, so the Scanner's view and the agent's view of the same weakness are one exposure. A detection that moves (for example a finding re-pointed at another asset) moves between exposures, and both exposures are reassessed.
Open, resolved, revived
An exposure is open while any of its members is still open:
- a finding that is not closed and not marked a false positive;
- a Scanner detection the Scanner still reports;
- an endpoint security detection the vendor still reports and has not closed; a suppressed detection is still reported.
It is resolved when none of them is. A finding closed in the workflow does not resolve the exposure by itself: if the Scanner still reports the weakness, the exposure stays open and stays on the attack paths. The Scanner marks a weakness fixed only when it ran the check again and the check passed, which is the point at which the member closes. An endpoint security vendor closes a detection when its sensor no longer finds the vulnerable software, which closes that member the same way. A detection the vendor simply stops returning closes the member too, but is not evidence that anything was fixed.
An exposure comes back when a member returns: a finding reopened, or the next scan finding the same weakness on the same asset again. The exposure is the same exposure, with its history, and its paths return with it.
The evidence factors
Every member carries signals, and the exposure reads each factor from the strongest signal among its members. There are five factors, in the order the model ranks them:
| Factor | Question it answers | Strongest to weakest |
|---|---|---|
| Threat | Is this weakness being exploited in the world? | Active exploitation, known exploited, campaign activity, tooling available, weak signal, none |
| Exploitability | How easily can it be exploited? | Demonstrated, reliable public exploit, practical, theoretical, none |
| Validation | Has anyone demonstrated it here? | By a person, by an automated validation, none |
| Reachability | Can an attacker get to it? | Internet-facing, externally reachable, internally reachable, segmented, isolated |
| Severity | How bad is the flaw? | Critical to informational |
The order matters: real-world attackability comes before technical severity, so a medium weakness with a public exploit on an internet-facing asset reads as a larger exposure than a critical weakness nobody can reach. The exact weights are part of the versioned model and are not something to tune by hand.
Validation is read apart from what it demonstrated. A test that reached root level is recorded as such on the exposure, and that level flows into the attack paths; it does not make the validation signal stronger than a test that reached user level.
A finding's own statements count. A tester who marks a finding as reachable from the internet, or records the level of compromise a test achieved, sets what the exposure reads, and a later scan does not overwrite it.
The assessment
From the factors the model produces an assessment for the exposure:
- a contribution: the modeled likelihood, within the horizon, that this exposure is exploited. This is the figure an attack path uses for the exposure when it is an entry, and it is re-read from the attacker's position when it is a later step;
- the inputs that produced it, kept with it, so the figure can be explained later.
An exposure is reassessed when its evidence changes, when its membership changes, when the model version changes, and on a periodic sweep. Every assessment is kept, with what changed since the previous one, so the history of a figure is a history of its evidence.
Confidence
Beside the assessment the model reports confidence in it, from four components:
| Component | Meaning |
|---|---|
| Data completeness | How many of the evidence inputs were measured rather than missing |
| Data freshness | How recent the latest observation is, falling to nothing over the model's freshness horizon |
| Validation coverage | Whether anyone attempted validation, whatever the outcome |
| Asset and path context | Whether the asset's position in the network is known |
Confidence qualifies a figure; it never changes one. A thinly evidenced exposure keeps its contribution and is flagged as thinly evidenced, so you can decide whether to validate it rather than have the model quietly discount it. On the Risk Posture page confidence is summarised across paths, weighted by each path's likelihood.
Missing evidence is not evidence of absence. An exposure whose threat signal is unknown is not read as unthreatened; the model records the input as unknown and the confidence says so.
What to do with this
- A finding closed without a retest, while the Scanner still reports the weakness, is still an open exposure. Retest it, or let the next scan confirm the fix.
- Validation is the cheapest way to raise both the figure's accuracy and its confidence: a demonstrated step changes what the attack paths yield, and a failed attempt is recorded too.
- Zones matter. An exposure on an asset in no zone cannot be placed on a path, and the coverage figure says so. See Organizations, business units, and zones.
Next
- Attack paths - how exposures become steps
- Modeled risk - the figures built from them
- Findings and triage - working the findings behind the exposures