Cybersecurity area
Exposure
Exposure Management helps organizations understand which vulnerabilities, configurations, external assets, and attack paths represent real risk.
What This Area Covers
Exposure focuses on how an attacker sees the organization: vulnerabilities, public services, cloud and SaaS exposures, misconfigurations, missing patches, open attack paths, and weaknesses that may lead to compromise. It is broader than vulnerability scanning alone.
Why It Matters
Without prioritization, teams receive a long list of findings that cannot realistically be fixed. Exposure Management and CTEM help identify which issues are exploitable, which assets are critical, and which remediation actions reduce risk the most. This is why vulnerability scanners, patch management, attack surface, breach and attack simulation, security visibility, and critical path mapping belong together.
How To Navigate This Area
Classic vulnerability scanning alone is not enough. The current direction is continuous exposure management and CTEM: prioritization by exploitability, impact, asset criticality, internet exposure, and realistic attack paths. The goal is to focus effort where risk reduction has the greatest effect.
The key is to connect technical findings with business context. A vulnerability on an isolated system does not have the same priority as a weakness on a public service with access to critical data. The solution should help move from a list of problems to managed remediation, task ownership, and verification that risk was actually reduced.
The technology list below works as a map of the Exposure area. The practical sequence is to name the security problem first, select the closest technology category second, and only then compare relevant vendors. This helps separate similar-sounding solutions and reduces the risk of adding another tool without a clear architectural role.
Technical Section Schema
Questions To Ask When Selecting A Solution
- Which assets are exposed to the internet or partners?
- How are vulnerabilities and missing patches prioritized today?
- Is prioritization based only on CVSS, or also on exploitability, asset criticality, and attack path?
- Can the organization verify whether security controls actually work?
- Are the most likely attack paths to critical systems known?
How To Use This Section
Each technology page expands one category, explains its architectural role, and lists SecTec portfolio vendors related to that area. The section page is therefore the orientation layer, while the detail pages support concrete mapping to solutions.
Vendors From The SecTec Portfolio
Attack coverage and defensive context
MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.
Practical attack scenarios
- Phishing and identity abuseAn adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
- Public application or API abuseAn adversary exploits a vulnerable web application, API, client-side code, or software component for initial access and execution.
- Cloud and SaaS compromiseAn adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
- Lateral movement inside the networkAfter initial access, an adversary discovers systems, accounts, and services and moves toward higher-value assets.
- Malware and Command and ControlMalicious code executes, maintains access, and communicates with adversary infrastructure through common or covert channels.
- Data exfiltration and leakageAn adversary searches for, collects, and transfers sensitive data from endpoints, cloud services, email, or internal repositories.
- Ransomware and availability impactAn adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
- Supply chain and trusted accessAn adversary abuses a supplier, software dependency, external access path, or trusted relationship to bypass normal controls.
- Attacks on OT and IoT environmentsAn adversary discovers industrial or connected devices, abuses remote access and network services, and threatens operational availability.
- Reconnaissance and attack surface mappingAn adversary collects information about people, systems, cloud services, and internet-facing infrastructure and searches for a viable initial-access path.
- Business Email Compromise and mailbox takeoverAn adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.
- Privilege escalation and persistenceAn adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.
- Insider threat and authorized access abuseAn insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
- Sensitive business flow and bot abuseAn automated adversary abuses legitimate functionality such as purchasing, booking, registration, voting, commenting, or account recovery.
- API security misconfiguration and exposed interfacesInsecure defaults, debug endpoints, broken CORS, verbose errors, or missing security headers expose data and functionality to an adversary.
- Shadow and zombie APIs without managed inventoryUnknown, forgotten, or outdated API versions remain reachable without current controls, ownership, documentation, and monitoring.
Relevant ATT&CK techniques
- T1018 · Remote System DiscoveryDetect, Validate
- T1021 · Remote ServicesDetect, Validate
- T1041 · Exfiltration Over C2 ChannelValidate
- T1046 · Network Service DiscoveryDetect, Prevent, Validate
- T1068 · Exploitation for Privilege EscalationPrevent, Respond
- T1071 · Application Layer ProtocolValidate
- T1078 · Valid AccountsDetect, Validate
- T1087 · Account DiscoveryDetect, Validate
- T1189 · Drive-by CompromisePrevent, Respond
- T1190 · Exploit Public-Facing ApplicationDetect, Prevent, Respond, Validate
- T1210 · Exploitation of Remote ServicesDetect, Prevent, Respond, Validate
- T1486 · Data Encrypted for ImpactValidate
- T1566 · PhishingValidate
- T1592 · Gather Victim Host InformationDetect, Prevent, Validate
- T1595 · Active ScanningDetect, Prevent, Validate