The exposure field guide
How to stand up an exposure programme in ninety days without stopping the work you already committed to.
42 pagesResources
Everything we would hand a security team on day one
The field guide, the scoring framework we actually use, the ownership workshop format and a board pack you can adapt. No form wall on this template — wire one up if your programme needs it.
Start hereThe exposure field guide
Ninety days from first connection to a board report, written as a plan rather than a pitch.
Library
Six things worth your afternoon
Attack path scoring framework
The scoring model behind path ranking, written out so you can challenge it or adopt it.
18 pagesOwnership resolution playbook
The workshop format, the RACI and the escalation ladder for assigning owners to 20,000 assets.
Template packBoard reporting pack
A two-page posture brief with the measurement method included, ready to adapt.
2 pages + notesExposure benchmarks 2026
Median remediation times and path counts across 140 anonymised programmes in the demo dataset.
26 pagesReading a path before you fix it
A 35-minute walkthrough of three real-shaped paths and the choke points chosen for each.
35 minThe method
The five movements, in one page
This is the spine of the field guide, and the structure the whole product follows.
- 01Everything you own, including what nobody remembers owningContinuous discovery across domains, cloud accounts, APIs, identities, endpoints and the SaaS holding your data. Ownership is inferred, then confirmed by a human.
- 02How exposure actually reaches what mattersAssets are placed on five strata, from the internet edge down to regulated data. Relationships between them become traversable paths, not a wall of dots.
- 03The seven paths that break you, not the 4,000 that do notA finding matters when it sits on a path that terminates somewhere expensive. Everything else waits its turn, and we say so plainly.
- 04Owned work with a date on itChoke points collapse many findings into one fix. Each one becomes a ticket in the tracker the owning team already uses, with an SLA and a named human.
- 05Improvement you can put in front of a boardExposure score, path count and remediation velocity over time, with the measurement method written out so nobody has to trust the number blindly.
From the blog
All articlesShorter reads
Exposure programmesSeverity is not priority, and treating it as one is why your backlog never shrinksA critical finding on an unreachable asset is a worse use of an engineer's Tuesday than a medium finding two hops from your customer master. Here is how to score work by consequence instead.Read itField notesThe asset you forgot is the one they found: a field note on shadow surfaceAcross a year of exposure assessments, the systems that mattered most were rarely the ones on the inventory. They were the staging clone, the acquired subsidiary's mail relay, and the portal a departed team stood up in 2021.Read it
Next step
See your own surface the way an attacker reads it
A four-week proof of value connects one cloud account, your DNS and your identity provider, and ends with a written readout of what was found.
Book a walkthroughOpen the console demo
Illustrative product data. Nothing on this site performs a live scan.