Exposure management

Exposure management reorders the work around what an attacker can actually reach and use, rather than what a scanner found.

It is the difference between a list of flaws and a list of paths. A high-severity issue behind three other controls, unreachable from anywhere an attacker stands, matters less than a moderate one directly on the internet. Thinking in paths rather than findings is the shift, and it usually shortens the urgent list considerably.