THE EXPOSURE DESK
The Exposure Desk: dated notes on ASM and exposure management
SHORT ANSWER
Dated notes on what changes the choice of an exposure tool: how vendors describe acting at the edge, what proof of exploitability means in practice, how discovery starts, and what the 2026 CVE forecasts say. Every note states its publication date and the dates of its sources. Vendor figures are quoted as the vendors' statements.
- 2026-10-11 · 3 min readNine Exposure Shapes, Different Answers: The Finder's Test Profiles
We ran the finder on nine example organisations. Different shapes point to different tool types and vendors. Here is each result, computed, after our 11 October update.
Method - 2026-10-10 · 2 min readWhat Proof of Exploitability Means in 2026: Four Approaches Vendors Describe
Non-intrusive simulation, black-box testing, agentic attack testing and runtime validation: how four approaches to proving exposure differ, from vendor pages.
Proof - 2026-10-08 · 3 min readTenable, Rapid7 and Palo Alto Networks: Where the Platform Vendors Stand on Exposure in 2026
What Tenable One, the Rapid7 Command platform and Cortex describe for exposure management, the announcements of 2026, and when a platform fits better than a specialist.
Platforms - 2026-10-06 · 3 min readActing at the Edge: How Three Vendors Describe Compensating Controls
WAF posture, edge rules and response playbooks: what IONIX, watchTowr and Cortex Xpanse describe for acting on an exposure before the fix ships.
Edge - 2026-10-04 · 2 min readTwelve Questions to Ask in Any Exposure Management Demo
Twelve questions, one per check the finder uses, to put to any ASM or exposure management vendor in a demo, and what a good answer looks like.
Method - 2026-10-02 · 2 min readThe First 30 Days of an Acquired Company's Attack Surface: A Working Checklist
A practical checklist for the internet-facing assets of a newly acquired company: inventory, ownership, edge protection, quick wins and the first CTEM cycle.
DiscoveryEdge - 2026-09-30 · 2 min readCompany Name, Seeds or a Prebuilt Inventory: How Discovery Starts at Five Vendors
What each vendor needs from you before discovery begins, from a company name to seeds to a prebuilt inventory, and why it matters for a proof of concept.
Discovery - 2026-09-28 · 2 min readMore CVEs, Same Exploitable Share: What FIRST's 2026 Forecasts Mean for Exposure Teams
FIRST forecast a median of 59,427 CVEs for 2026 in February and about 66,000 in June, but says the exploitable share has not grown. What that means for tool choice.
Field data