Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Enterprises Use Cyber Exposure Management
Transcript
- Lucas: So earlier this week I was looking at the SEC's new cybersecurity disclosure filings that started rolling in this quarter, and one number jumped out at me. Among the Fortune 500 companies that have filed so far, more than half cite 'inability to quantify cyber risk exposure' as a top concern for their investors — not the breaches themselves, but the inability to measure exposure. Luna: That's a really interesting shift. It's not just about 'did we get hacked,' it's 'do we even know how exposed we are?' Lucas: Exactly. And that's the gap that cyber exposure management is trying to close. It's a discipline that's been gaining steam over the past couple of years, but I'd argue 2026 is the year it's really hitting the mainstream. If today's episode was useful for what you're building or running, honestly, if it was worth a coffee to you, that's the link — buy me a coffee dot com slash fexingo. Luna: Yeah, listener support is what keeps this show ad-free and focused on the specifics. We're not sponsored by a vendor, so it's just us digging into the details. Lucas: Exactly. And speaking of specifics — let's define what exposure management actually is, because it's easy to confuse with vulnerability management. Vulnerability management says: here are all the CVEs in your environment, patch them by criticality. Exposure management says: here's every asset, every configuration, every identity, every cloud API — and here's how likely each one is to be exploited in a way that actually hurts your business. Luna: So it's vulnerability management plus business context plus threat intelligence, all synthesized into a single score or a prioritized list. Lucas: Right. And that synthesis is the hard part. Tenable, Qualys, CrowdStrike, Palo Alto Networks — they all have exposure management platforms now. But the concept really crystallized with the emergence of frameworks like CTEM — continuous threat exposure management — which Gartner first wrote about a few years ago. The idea is that you don't just scan quarterly. You continuously monitor your attack surface, validate whether your controls are working, and then mobilize remediation based on what matters most. Luna: I want to get into a concrete example. You mentioned a European airline that used exposure scoring. What did they do? Lucas: Sure. This was a case study from one of the exposure management vendors — I think it was Tenable. The airline had the typical sprawl: thousands of on-prem servers, hundreds of cloud instances, IoT sensors in baggage handling, contractor networks. Their vulnerability management team was drowning in alerts. They were getting something like 50,000 new vulnerabilities flagged per month. The team could only remediate about 2,000 per month, so they were essentially guessing which ones to prioritize. Luna: That's a 96 percent backlog. No team can handle that without a risk-based filter. Lucas: Exactly. So they implemented an exposure management platform that scored each finding based on three factors: the exploitability — how easy is it to weaponize; the asset criticality — is this server handling passenger data or just a printer; and the threat context — is this vulnerability being actively targeted by known ransomware groups. Once they applied that filter, their actionable priority list dropped from 50,000 to about 400 per month. And they cut their mean time to remediate from 45 days to 27 days. Luna: Forty percent improvement just by changing how they prioritize. That's not buying more tools — it's using the tools you have more intelligently. Lucas: And that's the value proposition. But there's a catch. Exposure management requires data integration that most enterprises don't have. You need to feed in asset inventory from your CMDB, vulnerability data from your scanners, threat feeds from your intelligence platform, and identity data from your IAM system. If those are all siloed, the exposure score is only as good as the weakest data source. Luna: So the CISO has to be a data integration champion. That's a very different skill set from the old days of 'install the firewall and patch on Tuesday.' Luna: Let me push back a little. Isn't there a risk of 'exposure score theater' — where you produce a nice dashboard number for the board, but it doesn't actually reflect real risk? Lucas: That's a fair concern. I've seen demos where the exposure score drops dramatically just because the vendor changed the weighting algorithm. But the better platforms are transparent about the methodology. Tenable's Exposure Score, for instance, is calculated using a published formula that includes base CVSS, temporal score, asset value, and a predictive model of exploit likelihood. It's not a black box. And the SEC filings are actually forcing more rigor, because if you disclose your risk management process, you have to be able to show that the metric actually drives decisions. Luna: Have you seen any companies using exposure scores in their cyber insurance applications? I've heard that's starting to happen. Lucas: Yes, and that's one of the most interesting developments. A few large insurers — I think Zurich and AXA are experimenting with this — are offering premium discounts if a company shares its exposure score and shows improvement over time. The logic is that a quantified, validated exposure metric is more reliable than a checklist of 'do you have MFA? do you have endpoint detection?' The insurer can actually model the risk. Luna: That aligns the incentives perfectly. The company gets lower premiums, the insurer gets better data, and both parties are focused on reducing actual exposure rather than checking boxes. Lucas: Right. And I think that's where the market is heading. The technology is mature enough now that the challenge is organizational. Getting the CISO, the CIO, the risk officer, and the CFO to agree on a single exposure metric — that's the hard work. But once you have that number, you can start having real conversations about risk appetite and investment. Luna: I want to go back to the airline example for a second. How did they get the organization to buy in? Because changing from a 'patch all criticals' mindset to a risk-based approach is a cultural shift. Lucas: From what I read, they started with a pilot on a single business unit — the cargo division, which had a relatively contained network. They ran the exposure management platform in parallel with their existing process for three months. At the end, they showed that the risk-based approach prevented two incidents that would have hit the cargo operation hard, while the old approach would have missed those because the patches were 'low criticality' on the CVSS scale. That proof of concept got them executive sponsorship. Luna: So it's about building a case study within your own organization. That's smart. And it ties back to what we were saying earlier about the SEC — having a defensible, quantified risk process becomes a competitive advantage. Lucas: Exactly. I think the companies that adopt exposure management early are going to have an easier time with compliance, with insurance, and with board communication. The ones that stick to traditional vulnerability management are going to find themselves explaining why they can't measure their risk in a way investors understand. Luna: And for our listeners who are in security leadership — what's one actionable step they can take this quarter to start moving toward exposure management? Lucas: I'd say pick one high-value asset — your customer database, your critical SaaS application, whatever keeps the lights on — and map every exposure path to it. Not just vulnerabilities, but misconfigurations, excessive permissions, unmonitored third-party integrations. Use that map to build a simple exposure score: number of exploitable paths divided by number of controls in place. It's crude, but it starts the conversation. Then you can bring in a platform to scale it. Luna: I like that. It's almost like a tabletop exercise but for quantification. And it doesn't require a big budget — just a spreadsheet and a few hours of focused analysis. Lucas: Exactly. And I think that's the right note to end on. Exposure management isn't about buying a magic dashboard. It's about changing how you think about risk — from 'how many CVEs are open' to 'how likely is a material breach and what are we doing about it.'