Guide / The exposure assessment guide
Know what the outside view can tell you.
An exposure assessment starts with the information and services visible beyond your organization. Use this guide to choose a useful question, understand the boundaries of discovery, and evaluate whether the final report gives your team enough evidence to take action.
Understand the outside view
Decision to inform
The business question behind the work
Discovered footprint
Assets and relationships needing review
Strength of evidence
Observed facts, inferences, and limits
Useful handoff
Actions that owners can evaluate and check
Four concepts help explain what an assessment can establish and how to use it.
01 / Guide
Start with a decision you need to make
A useful assessment answers a business question. You might need to understand a newly acquired footprint, find forgotten public services, or decide whether a suspected exposure deserves deeper validation. Write down the decision first. Then identify the assets and evidence needed to support it, including the questions an outside view alone will leave unresolved.
FIELD NOTES
- Name the change, concern, or decision that prompted the assessment.
- List known domains, brands, subsidiaries, and service owners.
- Define what evidence would change your next action.
02 / Guide
Separate discovery from demonstrated impact
An observed asset is a starting point. Its ownership, accessibility, and business relevance need review before it becomes an actionable finding. A public login page, for example, does not establish unauthorized access. Deeper validation needs an agreed objective and permission. The report should make the difference between observed facts, inferred relationships, and untested possibilities easy to understand.
FIELD NOTES
- Keep a source and observation date with each material claim.
- Resolve ownership before testing an unfamiliar asset.
- Record validation limits beside the finding they affect.
03 / Guide
Evaluate the handoff, not the finding count
A long inventory only helps when someone can use it. Look for an exposure map, findings with reproducible context, and a prioritized action plan. Each recommended change should point to a responsible team and a way to verify the result. A leadership readout should explain the important decisions without requiring the audience to interpret technical evidence.
FIELD NOTES
- Ask which findings need action and why they take priority.
- Check that asset owners can locate the relevant evidence.
- Agree which changes will receive a retest and how closure will be recorded.