Exposure management

What is exposure management?

Exposure management encourages organizations to mitigate risk based on their own priorities and circumstances rather than blindly adhering to “best practices,” chasing trends, or naively attempting to remove every possible security issue within their environment as soon as it’s discovered.

Those efforts can be viewed in much the same way as generalized diet and exercise guidelines: they might prove useful to many people, but their advice won’t be effective for everyone, and in some cases they can be actively harmful. Exposure management is more like visiting a physician in that it’s meant to find the best way to address specific issues based on individual needs, capabilities, and limitations while minimizing the risk of further harm.

Applying that approach to security involves an organization identifying its attack surface, considering the risks posed to critical assets, and determining how to minimize that risk based on its resources, priorities, and operating environment. This allows organizations to be proactive rather than reactive—similar to having annual physicals rather than relying exclusively on emergency medical care—and to prioritize legitimate risks over theoretical concerns. 

Why exposure management is essential for modern organizations

The modern threat landscape is teeming with everything from script kiddies hoping to get lucky with spray-and-pray attacks on everything with a public IP address to sophisticated adversaries willing to spend months planning an operation. Many organizations have larger attack surfaces than ever thanks to their dependence on software-as-a-service offerings, the rising popularity of hybrid environments, and the increasing number of devices they have to manage. This is a potent combination that makes securing modern orgs a different—and, in many ways, more difficult—challenge than it would have been in the past.

Many defenders have responded to this shift by changing the way they approach security. Rather than waiting for problems to arise, many organizations now work to proactively secure their most critical assets, as shown by the near-ubiquity of multi-factor authentication and continuous monitoring solutions. Neither of those tools were common even a decade ago; now signing in to something as low-stakes as an account for a fast food chain’s mobile app involves a lengthy password, one-time passcode, and the knowledge that the company will keep a record of every sign-in attempt for months or years.  

Those are just the public-facing changes organizations have made to their approach to security. Behind the scenes, many organizations have made even more sweeping changes to the ways they secure their environments, whether it’s by implementing a Zero Trust architecture or simply making sure their logging system is more than just a cron job that writes plain text files on a lone server. Exposure management is part of that shift, and it’s predicated on the idea that it’s better to identify, prioritize, and mitigate risks based on their merit rather than treating every potential threat the same way.

It’s somewhat like medical triage. (With the important caveat that we are not doctors, and have not played any on TV.) Someone who doesn’t consume the recommended amount of vegetables and has a substance abuse problem will probably be advised to abstain from those substances before they’re prescribed eight ounces of broccoli florets daily. A person with both a broken toe and a ready-to-burst appendix will ideally be rushed to an operating room instead of fitted for a walking boot. And if those scenarios involve the same person, well, hopefully they get the appendectomy before the eat-your-veggies lecture.

Improving an organization’s security posture via exposure management is similar. The org’s defenders might choose to patch a medium-severity vulnerability that affects a critical asset before a critical vuln that’s already been mitigated by other factors within the environment, for example, or focus on safeguarding data that isn’t supposed to be public before implementing a stricter policy for passwords used to access individual email accounts. They aren’t considering the risk associated with certain flaws in a vacuum; they’re prioritizing their resource usage based on their specific circumstances.

This can be difficult to explain outside the security industry because, from a logical standpoint, of course organizations would prioritize addressing the risks that could have a greater impact on their operations. But traditional security paradigms often place more value on meeting arbitrary standards, regulatory concerns, and compliance requirements than on mitigating genuine threats to an individual organization. Exposure management doesn’t make those requirements go away, but it can help organizations do more than just the bare minimum to protect their most important assets from their greatest threats.

The exposure management lifecycle: A step-by-step approach

So how do organizations implement an exposure management program? It’s a repeated cycle that involves learning about what’s actually in their environment and how adversaries might attack it, assessing which risks are most likely to be exploited or might have the worst consequences if they are compromised, using those assessments to prioritize their response to each risk, and then continuously monitoring for additional threats and validating the effectiveness of earlier remediation attempts. Let’s break it down.

Discovering the entire attack surface

Organizations can’t defend what they don’t know about. Exposure management starts with identifying the organization’s attack surface, or the sum total of ways adversaries might try to penetrate their defenses, so defenders know what they’re dealing with. This step also involves some degree of value judgment based on the organization’s needs; not all assets are created equal.

Contextualizing exposures and understanding risk

Once they know what’s in the environment, defenders can start deciding how to most effectively mitigate the risks each aspect of that attack surface poses to the organization. Methods that might be appropriate for securing critical assets could be considered overkill for something that’s present in the environment but isn’t sensitive or would be trivial to replace. Similarly, a lax security policy for low-value assets would be inappropriate for something central to the organization’s continued operation. Context matters.

Prioritizing remediation efforts

Nothing security-related happens in a vacuum. A critical vulnerability in popular software being disclosed at the same time an alert comes in about someone’s credentials appearing in a data dump is considered “normal.” The decisions made in the previous step help defenders focus their efforts on whichever problem represents the greatest risk to their particular organization rather than the issue that’s attracting the most attention from the infosec community. Sometimes those are the same thing; often they are not.

Mitigating and remediating identified exposures

This is where the defenders implement whatever mitigations or remediations they prioritized in the previous step with much consideration for potential downtime for critical services or other organizational hurdles that will likely be present. 

Continuous monitoring and validation

Organizations are largely abandoning the idea that a single assessment that considers the risks to their operations at a specific point in time is sufficient in the modern threat landscape. Instead they are relying on continuous monitoring solutions to receive up-to-the-minute information about what’s happening in their environments so they can assess potential risks and confirm that whatever measures they took in the previous step were effective. This is often combined with threat intelligence feeds and other data sources to help defenders remain aware of the current threat landscape.

Key components of an effective exposure management program

Exposure management requires more data than many traditional approaches to security. Defenders need to know exactly what’s in their organization’s environment, from what software is being used and on what systems to which third-party services they rely on, and they have to complement that knowledge with information about newly discovered threats and the latest in adversarial tradecraft. Continuing the medical comparison: doctors rely both on information about their patient—family history, current habits, lab results—and about what illnesses are “going around” or might be more dangerous than usual.

Comprehensive asset inventory and visibility

This answers the question of what’s present within the organization’s environment. Rather than relying on hearsay, cobbled-together documentation, and other unreliable sources of such information, a variety of tools now make it possible for defenders to collect all the relevant details they need about their organization’s digital infrastructure. Without this information, any risk assessment would be incomplete at best and woefully inaccurate at worst.

Real-time threat intelligence integration

This informs defenders about what’s happening outside their organization. Threat intelligence platforms offer details about commonly targeted vulnerabilities; the tactics, techniques, and procedures adversaries have used in recent operations; and the appearance of leaked credentials, zero-day vulnerabilities being auctioned off to the highest bidder, and other information about what’s being discussed on the dark web. All of this data can help defenders identify, assess, and prioritize risks to their organization. 

Attack Path Analysis and Simulation

This allows defenders to see how adversaries could move through their organization’s environment. They rarely compromise a high-value asset right away; instead they have to abuse the relationships between identities to make it from the initial point of compromise to their ultimate target. Attack Path Analysis shows defenders these chains, while Attack Path Simulation offers a glimpse at what an adversary following those chains looks like.

Automated risk scoring and prioritization

This helps defenders quickly assess risks to their environment. Automated risk scoring and prioritization tools use much of the same information discussed above to determine the severity of a particular risk, collect that data into an easy-to-read summary, and then present their findings to their operators. It’s still up to defenders to implement mitigations and remediations, but these automated tools can help manage a potentially overwhelming amount of data.

The future of exposure management

Exposure management is an evolving discipline that organizations are constantly learning how to improve. Perhaps the biggest shift to the practice is expected to arrive via the use of AI agents that can expand on the capabilities offered by automated risk scoring and prioritization tools, whether it’s by predicting future threats rather than simply identifying current ones or even promising to automatically remediate some problems on the organization’s behalf.

The predictive capabilities of AI agents would likely be informed by the same machine learning principles that have been employed for years. This is effectively pattern recognition for computers: they are given tremendous amounts of data, shown how each point might be connected to another, then asked to find similar connections in other data. This technology is used by streaming music platforms to recommend new songs based on your listening habits, for example, or by social platforms that attempt to guess at what posts you’d like to see rather than just presenting a reverse chronological feed.

Similar techniques are used by existing security tools, too, but the hope is that AI agents would be able to combine those capabilities with the ability to automatically remediate some of the risks they identify. This would require greater trust than automated risk assessments or even predictive analysis—an error in whatever remediation method the agent used could have consequences ranging from a minor inconvenience to a serious incident unto itself—but it would also reduce the amount of time it takes to respond to perceived risks and free up defenders to focus their efforts on other tasks.

Exposure management is unlikely to be truly automated, at least in the near term, if only because organizations will require a “human in the loop” to be held responsible for an AI agent’s actions. But as adversaries increasingly leverage AI agents in their own operations, it makes sense for organizations to look for ways to further reduce their exposure to particular risks. Defenders no longer have days, weeks, or months to address potential issues; anything that promises to shorten response times will be given a chance to prove itself.