TL;DR: A new PHP2Shell-style flaw is less a one-off event than a repeatable test of asset visibility, exploitability and business impact, according to WithSecure. The case for exposure management is now operational: teams need continuous discovery, not post-advisory spreadsheet triage.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on WithSecure's blog post: Exposure management is about continuous visibility into what exists, what is affected and what to prioritise when a new flaw emerges.
Why it matters: For IAM, NHI and security teams, the value is faster impact assessment across identities, assets and cloud services before exposure turns into incident response debt.
Context
Exposure management is the discipline of continuously discovering exposed assets, confirming what is vulnerable and ranking what matters most when a new issue lands. In practice, the control problem is not only patching speed but knowing which systems, identities and services are actually in scope before attackers can exploit the gap. For MSPs and internal security teams alike, the starting position is usually fragmented rather than complete.
That fragmentation becomes more serious when exposure spans on-premise assets, cloud services and digital identities. A single advisory can touch different owners, environments and remediation paths, so visibility has to be paired with shared prioritisation. The problem space overlaps with NHI governance because service accounts, API credentials and other digital identities often sit inside the same exposure picture. Exposure management becomes the bridge between discovery and action.
Key questions
Q: How do exposure management programs identify what is affected first?
A: Exposure management programmes identify what is affected first by continuously discovering assets, mapping them to internet exposure, software version, known vulnerabilities and criticality. The first remediation targets are usually internet-facing systems, privileged endpoints, exposed credentials and assets tied to business-critical services, because these create the fastest route to compromise and wider blast radius.
Q: Why do exploitable CVEs need more than CVSS scoring?
A: CVSS describes potential severity, not whether the issue is present in a live execution path or likely to be abused in your environment. Reachability, exploit intelligence, and application context change the answer. Without those inputs, teams may either overreact to dormant dependencies or miss real attack paths that deserve immediate remediation.
Q: How does continuous asset discovery support identity governance?
A: Continuous asset discovery supports identity governance by keeping the inventory of accounts, entitlements and infrastructure current, including machine identities, service accounts and cloud services. That visibility helps teams find orphaned accounts, excessive privileges, stale credentials and unmanaged integrations before they are missed in access reviews or decommissioning.
Q: What is the best way to prioritise remediation after a major advisory?
A: The best way to prioritise remediation after a major advisory is to rank affected systems by exploitability, exposure and business criticality, then fix the combinations that are both easy to attack and tied to sensitive business function. Internet-facing assets, privileged systems and shared services should move first, especially where no compensating control exists.
Technical breakdown
Continuous discovery across assets, cloud and identities
Exposure management works by maintaining an up-to-date inventory of externally reachable assets, software versions and identity-related exposures across environments. The point is not just to list assets, but to connect them to vulnerability data and ownership so teams can answer what is affected as soon as a new issue appears. In this model, discovery is continuous rather than periodic, which matters because unmanaged systems and digital identities often sit outside the normal change process. See the Attack Surface Management Maturity Model.
Practical implication: Use continuous discovery to close the gap between asset existence and remediation ownership before advisories create blind spots.
Exposure scoring is broader than CVSS
A pure severity score does not capture whether a vulnerability is likely to be exploited in a specific environment. Exposure management combines exploitability, attacker motivation and business impact so the highest-risk items surface first, not merely the loudest ones. That is especially useful when many assets share the same software flaw but only a subset are internet-facing, partner-exposed or tied to sensitive services. See the Continuous Automated Red Teaming (CART) Guide.
Practical implication: Rank remediation by exploitability and business impact, not by vulnerability severity alone.
Partner-specific reporting changes remediation workflow
For managed service providers, exposure management also has a reporting function: the same finding must be expressible per client without reconstructing the analysis manually. That requires a common data model across multiple estates, plus enough context to separate shared vulnerabilities from partner-specific exposure. The technical challenge is as much about normalising evidence as it is about finding it. See the Exposure Management Buyer's Guide.
Practical implication: Standardise partner views so one assessment can be reused without rebuilding the same triage in spreadsheets.
Threat narrative
Attacker objective: Exploit a newly disclosed weakness before the defender can map scope and prioritise the systems that are most exposed.
- Entry begins when a newly disclosed flaw creates a path into exposed systems before defenders have a complete inventory of what is reachable.
- Escalation follows when vulnerable versions or exposed services remain unprioritised because teams cannot tell which assets matter most.
- Impact occurs when the organisation spends its response window discovering scope instead of remediating the highest-risk systems first.
Breaches seen in the wild
- Gravity SMTP CVE-2026-4020 API Keys Exposure: CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.
- United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Exposure management becomes a decision system, not a dashboard. The practical value is not volume of telemetry but faster decisions about what is exposed, what is affected and what must go first. That shifts the programme from passive visibility to operational triage, which is where response time is won or lost. Practitioners should treat exposure data as a prioritisation engine, not as a reporting layer.
Digital identity has to be part of exposure scope. When the subject spans cloud services and on-premise assets, service accounts and other machine identities often sit inside the same blast radius as the vulnerable software. That makes identity inventory a discovery problem, not just an IAM hygiene problem. Exposure management that ignores identities misses the paths attackers use to move from vulnerable software into governed access.
Exposure-to-action latency: the real control gap is the delay between discovering a new issue and turning that knowledge into an owned remediation plan. The longer that delay lasts, the more the organisation pays in manual reconciliation, duplicated analysis and inconsistent prioritisation. Practitioners should measure how quickly a new advisory becomes a ranked, named and assigned work item.
MSP reporting pressure reveals a governance problem, not a tooling problem. Multi-partner environments fail when each client estate has to be rebuilt from scratch after every advisory. That creates inconsistency in what gets fixed first and makes assurance harder to defend. Practitioners should use partner-level reporting to enforce a single exposure model across distributed estates.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Attack Surface Management Maturity Model
What this signals
Exposure-to-action latency: the next differentiator is not whether a team can find vulnerable systems, but whether it can turn a fresh advisory into an owned remediation queue before attackers exploit the delay. That means security operations, IAM and platform teams need shared discovery data rather than separate spreadsheets.
The practical signal for the next cycle is a move toward unified exposure views that span infrastructure and digital identity, because the same vulnerability often creates different risks in each layer. Teams that cannot see service accounts and cloud services together will keep losing time in manual scoping.
Exposure management will increasingly function as the handoff point between detection, ownership and remediation, especially in MSP environments where the same issue must be translated for multiple clients. Programme leaders should expect more pressure for reusable assessments and less tolerance for one-off triage.
For practitioners
- Build a continuous asset and identity inventory Track on-premise systems, cloud services and digital identities in one exposure model so a new advisory can be assessed against real scope instead of assumptions.
- Score remediation by exploitability and impact Weight internet exposure, attacker interest and business criticality above raw severity so the queue reflects likely harm, not just CVSS.
- Standardise partner-level exposure reports Create a repeatable reporting view that can be shared across partners without rebuilding the assessment each time a new issue appears.
- Map exposed services to accountable owners Assign ownership for every vulnerable asset, including unmanaged and orphaned systems, so triage does not stall when an advisory arrives.
Key takeaways
- The core problem is not the lack of alerts, but the lack of a reliable, shared view of what is exposed when a new flaw appears.
- Exposure management matters because remediation quality depends on scope, ownership and prioritisation, not just on knowing that a vulnerability exists.
- Organisations that connect asset discovery, identity visibility and business impact can convert advisories into ranked action faster than teams that rely on manual triage.
Related NHI Mgmt Group resources: Exposure Management and CTEM Guide · Attack Surface Management Maturity Model · Exposure Management Buyer's Guide · Identity Visibility and Intelligence Platforms (IVIP) Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | Exposure management depends on knowing what assets exist before a new flaw lands. |
| CIS-7 — Continuous Vulnerability Management | The article is about continuous assessment and prioritisation after advisories. | |
| Recommendation — Maintain an authoritative asset inventory so new advisories can be matched to real scope quickly. Run continuous vulnerability management so new exposures are prioritised immediately. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical Devices and Systems Inventoried | Exposure management starts with knowing which systems are present and reachable. |
| ID.RA-01 — Vulnerabilities Are Identified and Recorded | The post centers on identifying vulnerable versions and mapping affected systems. | |
| Recommendation — Inventory assets continuously so exposed systems are identified before remediation begins. Record vulnerability findings centrally so triage can move from discovery to action. | ||
| MITRE ATT&CK | TA0001;TA0004 — Initial Access; Privilege Escalation | Newly exposed flaws are used to gain entry and then deepen access when scope is unclear. |
| Recommendation — Map exposed flaws to initial access and escalation paths to focus defensive hunting. | ||
Key terms
- Exposure management: Exposure management is the practice of identifying which assets are reachable by attackers and reducing that reach before exploitation occurs. For collaboration systems like SharePoint, it is not enough to know that a patch exists, because public accessibility changes the speed and likelihood of attack.
- Attack Surface Management: Attack surface management is the practice of finding and evaluating assets that could be exposed to misuse or compromise. CAASM focuses on internal visibility across the environment, while EASM focuses on externally reachable assets. It is a discovery discipline, not a complete identity control model.
- Continuous Automated Red Teaming: Continuous Automated Red Teaming is the ongoing use of automated attack simulations to test security controls, detection, and response. It repeatedly emulates adversary behavior across systems, identities, and workflows, then measures whether defenses detect, block, or contain the activity. The goal is to expose control gaps before real attackers do.
- Cloud Services: Cloud services are computing resources delivered over a network on demand, such as infrastructure, platforms or software. They are accessed through provider-managed APIs, consoles and identity controls, and organisations usually govern them with accounts, roles, API keys and logging to control who can provision, configure and use shared resources.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to the wider security programmes they run.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org