Lodemark
Sign inBook a walkthrough
Blog

Notes from the exposure and detection teams

Practical write-ups about running an exposure programme: what to prioritise, what to ignore, and how to report it to people who do not read CVE identifiers.

Topics
  • Exposure programmes
  • Field notes
  • Security leadership
Latest · Exposure programmes

Severity is not priority, and treating it as one is why your backlog never shrinks

A critical finding on an unreachable asset is a worse use of an engineer's Tuesday than a medium finding two hops from your customer master. Here is how to score work by consequence instead.

Asha Rehman · Head of Exposure Research2026-09-089 minRead the article
Field notes

The asset you forgot is the one they found: a field note on shadow surface

Across a year of exposure assessments, the systems that mattered most were rarely the ones on the inventory. They were the staging clone, the acquired subsidiary's mail relay, and the portal a departed team stood up in 2021.

Deniz Arar2026-08-197 min
Exposure programmes

Choke points beat tickets: collapsing forty findings into one change

When you model paths rather than findings, the same fix keeps appearing. Selecting on that overlap is the highest-leverage decision an exposure programme makes.

Ivo Petran2026-07-306 min
Security leadership

Reporting exposure to a board without a single scary chart

Boards do not need to be frightened; they need to know whether the thing is getting better, how you know, and what you want from them. Two pages is enough.

Sanne de Boer2026-07-028 min
Next step

Prefer the long version?

The exposure field guide covers the whole ninety-day programme: discovery, ownership, path modelling, choke points and the first board report.

Open the resource libraryBook a walkthrough

Illustrative product data. Nothing on this site performs a live scan.