Exposures and evidence

A finding is one problem on one asset as one source saw it. An exposure is the weakness itself: one weakness on one asset, however many sources saw it. A network scan, an endpoint agent, an endpoint security vendor and a tester's finding can all describe the same hole in the same server; the CyberOptix CTEM Platform places all of them under one exposure, and it is the exposure that attack paths and the Risk Posture figures are built from.

What belongs to an exposure

Each detection the platform holds becomes a member of exactly one exposure, decided by what it detected and where:

• the asset it was found on;
• the weakness: the set of vulnerabilities for a Scanner detection, the check and its location for a configuration finding, or the catalog entry for a manual finding.

An agent's detection on a host counts on the host, so the Scanner's view and the agent's view of the same weakness are one exposure. A detection that moves (for example a finding re-pointed at another asset) moves between exposures, and both exposures are reassessed.

Open, resolved, revived

An exposure is open while any of its members is still open:

• a finding that is not closed and not marked a false positive;
• a Scanner detection the Scanner still reports;
• an endpoint security detection the vendor still reports and has not closed; a suppressed detection is still reported.

It is resolved when none of them is. A finding closed in the workflow does not resolve the exposure by itself: if the Scanner still reports the weakness, the exposure stays open and stays on the attack paths. The Scanner marks a weakness fixed only when it ran the check again and the check passed, which is the point at which the member closes. An endpoint security vendor closes a detection when its sensor no longer finds the vulnerable software, which closes that member the same way. A detection the vendor simply stops returning closes the member too, but is not evidence that anything was fixed.

An exposure comes back when a member returns: a finding reopened, or the next scan finding the same weakness on the same asset again. The exposure is the same exposure, with its history, and its paths return with it.

The evidence factors

Every member carries signals, and the exposure reads each factor from the strongest signal among its members. There are five factors, in the order the model ranks them:

Factor	Question it answers	Strongest to weakest
Threat	Is this weakness being exploited in the world?	Active exploitation, known exploited, campaign activity, tooling available, weak signal, none
Exploitability	How easily can it be exploited?	Demonstrated, reliable public exploit, practical, theoretical, none
Validation	Has anyone demonstrated it here?	By a person, by an automated validation, none
Reachability	Can an attacker get to it?	Internet-facing, externally reachable, internally reachable, segmented, isolated
Severity	How bad is the flaw?	Critical to informational

The order matters: real-world attackability comes before technical severity, so a medium weakness with a public exploit on an internet-facing asset reads as a larger exposure than a critical weakness nobody can reach. The exact weights are part of the versioned model and are not something to tune by hand.

Validation is read apart from what it demonstrated. A test that reached root level is recorded as such on the exposure, and that level flows into the attack paths; it does not make the validation signal stronger than a test that reached user level.

A finding's own statements count. A tester who marks a finding as reachable from the internet, or records the level of compromise a test achieved, sets what the exposure reads, and a later scan does not overwrite it.

The assessment

From the factors the model produces an assessment for the exposure:

• a contribution: the modeled likelihood, within the horizon, that this exposure is exploited. This is the figure an attack path uses for the exposure when it is an entry, and it is re-read from the attacker's position when it is a later step;
• the inputs that produced it, kept with it, so the figure can be explained later.

An exposure is reassessed when its evidence changes, when its membership changes, when the model version changes, and on a periodic sweep. Every assessment is kept, with what changed since the previous one, so the history of a figure is a history of its evidence.

Confidence

Beside the assessment the model reports confidence in it, from four components:

Component	Meaning
Data completeness	How many of the evidence inputs were measured rather than missing
Data freshness	How recent the latest observation is, falling to nothing over the model's freshness horizon
Validation coverage	Whether anyone attempted validation, whatever the outcome
Asset and path context	Whether the asset's position in the network is known

Confidence qualifies a figure; it never changes one. A thinly evidenced exposure keeps its contribution and is flagged as thinly evidenced, so you can decide whether to validate it rather than have the model quietly discount it. On the Risk Posture page confidence is summarised across paths, weighted by each path's likelihood.

Missing evidence is not evidence of absence. An exposure whose threat signal is unknown is not read as unthreatened; the model records the input as unknown and the confidence says so.

What to do with this

• A finding closed without a retest, while the Scanner still reports the weakness, is still an open exposure. Retest it, or let the next scan confirm the fix.
• Validation is the cheapest way to raise both the figure's accuracy and its confidence: a demonstrated step changes what the attack paths yield, and a failed attempt is recorded too.
• Zones matter. An exposure on an asset in no zone cannot be placed on a path, and the coverage figure says so. See Organizations, business units, and zones.

Next

• Attack paths - how exposures become steps
• Modeled risk - the figures built from them
• Findings and triage - working the findings behind the exposures