EXPOSURE SCHOOL · 8 LESSONS
Exposure School: short lessons on choosing and running exposure management tools
SHORT ANSWER
Eight lessons in four tracks: reading the shape of your problem, proving which exposures are real, acting on findings, and running a CTEM programme. Each takes a few minutes, ends with what to do next, and links to the tool types and vendor notes it mentions.
Read the shape
- 01 · 3 minReading the Shape of Your Exposure Problem Before You Buy a Tool
Five questions that tell you whether your problem is finding assets, proving exposures, joining data, running a programme or keeping WAFs in step.
- 02 · 2 minCloud, On-Premises and Edge: Where Internet-Facing Assets Live
Why hosting changes what an exposure tool needs to see, and which tool types matter more in cloud, mixed and on-premises estates.
Prove it
- 03 · 2 minSafe Checks or Attack-Style Testing: How Much Proof Do You Need?
The difference between non-intrusive exploitability checks and attack-style testing, what each costs you, and how vendors describe their approach.
- 04 · 2 minRetesting and Proof of Fix: How to Know an Exposure Is Closed
Why a closed ticket is not a closed exposure, how retesting and regression testing work, and which vendors describe them.
Act on it
- 05 · 2 minCompensating Controls in Practice: WAF Rules, Edge Rules and Playbooks
How WAF rules, edge rules and response playbooks buy time while a fix is planned, what can go wrong, and which vendors describe applying them.
- 06 · 2 minBuilding on the Security Platform You Already Own
When extending Tenable, Rapid7, Palo Alto Networks or Microsoft makes sense for exposure management, and when a specialist that connects to it is the better fit.
Run the programme
- 07 · 2 minScoping a First CTEM Cycle You Can Actually Finish
How to choose the scope of a first continuous threat exposure management cycle, who needs to be involved, and what to report at the end.
- 08 · 2 minWriting a Proof of Concept Plan for Exposure Management Tools
How to run a fair proof of concept for ASM and exposure management tools: a fixed scope, known answers, the same questions for every vendor and a written result.