ELI5

Exposure and threat, explained simply

Every system has weak spots. What matters is which ones a burglar can actually reach, on the things you care about most.

The big idea

Imagine a house with a hundred small cracks in its walls. Most are on an inside wall, or behind a heavy wardrobe, or in the shed. A few are on the front of the house, next to the room where you keep your valuables. Fixing those few matters far more than counting all hundred.

Computer systems are the same. New weak spots, called vulnerabilities, are found every day, and big organisations have thousands open at any time. A long list feels scary, and a shorter list feels like progress, but the number on its own says little about how safe you are.

Exposure management asks better questions. Which weak spots can an attacker actually reach from outside? Which are already being used by real criminals? Which sit on the systems the business could not run without? And when one of those turns up, how quickly do we fix it?

Teams that work this way run it as a loop that never stops: decide what matters, find what is there, rank it, test whether it is really open, then get the right people to fix it.

Words you will meet

• Vulnerability: a weak spot in software or a setting that an attacker could use.
• Exploited: a vulnerability that criminals are actually using, not just one that could in theory be used.
• Exposure: a weakness an attacker can really reach and use.
• Edge device: equipment that faces the internet directly, such as a VPN box or firewall.
• CTEM: Continuous Threat Exposure Management, the loop of scoping, finding, ranking, testing and fixing.

The field notes, in plain words

• Vulnerability counts are the wrong number

  Counting every crack in the walls tells you little; what matters is the few cracks a burglar can actually reach on the rooms that matter most.

Ready for more? Exposure and threat: where things stand

Personal work and my own view, not my employer's. Sources are public.