AcademySecure & Govern

Exposure Management

The continuous threat exposure management cycle; prioritization with EPSS, KEV, reachability and business context; the attack surface beyond CVEs; non-human identities; the software supply chain; and structural reduction.

S202Practitioner13 slidesAbout 10 minutes

Start the course Download the PDF
1 / 13
PDF
AxiareteAcademy

S202Secure & Govern · Practitioner

Exposure Management

Prioritizing what attackers can reach and exploit, and reducing the attack surface itself.

FormatKnowledge pack · 13 slides
ForSecurity leaders and teams
LevelPractitioner
Axiarete Academy · S20202 / 13

The premise

Patching alone cannot keep pace with an expanding attack surface

Vulnerability volume grows faster than remediation capacity. Exposure management concentrates effort on what is reachable, exploitable and consequential, and removes exposure that does not need to exist.

ReachableOn a path an attacker can use.
ExploitableExploited already, or likely to be.
ConsequentialCritical systems and sensitive data.
Exposure ManagementSecure & Govern
Axiarete Academy · S20203 / 13

Context

Vulnerability data and policy changed in 2026

263%

growth in CVE submissions between 2020 and 2025. NIST enriched nearly 42,000 in 2025, a record, but could not keep pace.

NIST, April 2026

3 groups

Since April 2026, NIST prioritizes enrichment of CVEs in KEV (target: one business day), in federal-use software and in critical software; others are not scheduled for immediate enrichment.

NIST, April 2026

BOD 26-04

CISA replaced BOD 22-01 and BOD 19-02 with federal deadlines, as short as three days, set by asset exposure, KEV status, exploit automation and technical impact.

CISA, June 2026

NVD no longer routinely adds its own severity score where the CNA has provided one. Combine CNA and vendor data, exploitation evidence and your own context.

Exposure ManagementSecure & Govern
Axiarete Academy · S20204 / 13

Method

Continuous threat exposure management in five stages

Introduced by Gartner in 2022. Each round of mobilization feeds the next round of scoping.

1ScopingChoose the attack surfaces and business processes that matter most.
2DiscoveryFind the assets, vulnerabilities, misconfigurations and identities in scope.
3PrioritizationRank by exploitability, exposure and business impact.
4ValidationConfirm that attack paths work and that controls respond.
5MobilizationRoute remediation to owners on agreed timelines; agents can draft fixes for review.
Exposure ManagementSecure & Govern
Axiarete Academy · S20205 / 13

Prioritization

Prioritize with evidence, not severity alone

SignalWhat it tells youSource
CVSSBase score: technical severity of the flaw, not risk in your environmentVendor, CNA, NVD
EPSSProbability of exploitation in the wild within 30 daysFIRST (version 5, 2026)
KEVExploitation has been observed in the wildCISA catalog
ReachabilityWhether the vulnerable code or service can be reachedCode analysis, exposure scans
Business contextCriticality of the asset and sensitivity of its dataAsset inventory, CMDB, data classification
SSVCA decision in CISA’s tree: Track, Track*, Attend or ActCISA and CERT/CC
Exposure ManagementSecure & Govern
Axiarete Academy · S20206 / 13

Decision

Combine likelihood and impact into action

HigherLikelihood of exploitationLower
Fix on an accelerated cycleExploited low-value hosts become footholds; fix internet-facing ones first.
Act nowKnown or likely exploitation on critical, exposed assets.
TrackPatch in the standard cycle; reassess as the evidence changes.
Harden and monitorCompensating controls, segmentation and detection.
LowerBusiness impactHigher
Exposure ManagementSecure & Govern
Axiarete Academy · S20207 / 13

Attack surface

The attack surface is larger than the CVE list

Unknown assetsInternet-facing systems that IT does not know it runs.
MisconfigurationsOpen storage, permissive policies, exposed management interfaces.
Non-human identitiesService accounts, keys and tokens, often over-privileged and long-lived.
Third-party connectionsOAuth grants and integrations into SaaS and partners.
Software supply chainDependencies, build systems and update channels.
AI systems and agentsAgents and MCP servers that hold credentials and act on other systems.
Exposure ManagementSecure & Govern
Axiarete Academy · S20208 / 13

Identities

Non-human identities need a lifecycle

The OWASP Non-Human Identities Top 10 (2025) begins with improper offboarding and secret leakage.

InventoryEvery service account, key, token, certificate and agent identity.
OwnershipA named owner for each identity.
Least privilegePermissions matched to actual use.
Short-lived secretsRotation, or credentials issued per session.
Secret hygieneNo secrets in code, logs or tickets.
Environment isolationSeparate identities for production and test.
No reuseOne identity per workload, and none used by people.
OffboardingRemoved with the system or integration it served.
Exposure ManagementSecure & Govern
Axiarete Academy · S20209 / 13

Supply chain

Know what you run, and where it came from

SBOMA machine-readable list of components. Current releases: CycloneDX 1.7 and SPDX 3.0.1.
Minimum elementsJoint 2026 guidance replaces NTIA’s 2021 list, adding component hashes, licenses and SBOM author signatures.
VEXPer-product status: not affected (with a justification), affected, fixed or under investigation.
AI bills of materialsModels, datasets and their provenance; G7 minimum elements (May 2026); in CycloneDX since 1.5 and SPDX since 3.0.
Exposure ManagementSecure & Govern
Axiarete Academy · S20210 / 13

Structural reduction

Remove exposure that serves no purpose

RetireApplications that no longer serve a necessary purpose.
DisableUnused features, APIs and protocols.
ConsolidateOverlapping platforms with fragmented controls.
RevokeUnused privileges and stale identities.
RemoveIntegrations that have outlived their process.
ModernizeEnd-of-support software and devices that no longer receive patches.
Exposure ManagementSecure & Govern
Axiarete Academy · S20211 / 13

Measurement

Measure exposure removed and validated

Time to remediate KEVOn internet-facing assets, by asset criticality.
Validated exposureShare of critical assets whose attack paths were tested.
Exposure removedAssets retired, privileges revoked, integrations removed.
Inventory accuracyShare of discovered assets that were already known.
Expired exceptionsRisk acceptances past their expiry date.
Identity hygieneNon-human identities with an owner and rotation.
Exposure ManagementSecure & Govern
Axiarete Academy · S20212 / 13

Pitfalls

Why vulnerability programs plateau

Prioritizing by CVSS alone
Add exploitation evidence and context
Reporting ticket closures
Report exposure reduced on critical assets
Tickets without context
Route to owners with the evidence and the fix
Permanent exceptions
Every acceptance expires and is reviewed
Ignoring identities
Manage non-human identities as exposure
Defending what is unnecessary
Retire it, and remove the obligation
Exposure ManagementSecure & Govern
Axiarete Academy · S20213 / 13

Summary

Key takeaways

  1. Focus on what is reachable, exploitable and consequential.
  2. Run exposure management as a cycle: scope, discover, prioritize, validate, mobilize.
  3. Prioritize with EPSS, KEV, reachability and business context alongside CVSS.
  4. Treat non-human identities and the supply chain as part of the attack surface.
  5. Retiring unneeded systems, access and integrations removes exposure permanently.
Next course · O201AI in IT OperationsOperate · Practitioner
Exposure ManagementSecure & Govern

Further reading

Continue learning

S201 · Secure & GovernAI Governance in PracticeO201 · OperateAI in IT OperationsAxiarete AcademyAll courses and tracks

Bring this course to your leadership team

We run private working sessions that apply these frameworks to your own estate, data and pending decisions.

Request a Private BriefingExplore the Academy