SER-011 — Exposure Management
**Exposure as decision support**—how organizations use exposure **context**, reachability, relationships, and intelligence to prioritize reduction, scope investigation, and communicate risk. **Not** vulnerability management administration, scanner configuration, or vendor product tours.
SER-011 — Exposure Management
Series: SER-011
Volume: VOL-004 Security Operations
Version: 1.0
Fundamental question: How should organizations understand and reduce security exposure using Security Intelligence?
Pillar: PIL-EXPOSURE
Season: SEA-009
Status: ✅ Complete — FROZEN (D1 drafts)
Review: Every 6 months (next: 2027-01-03)
Expansion: SER-011 v2.0 only
Learning path: LP-011
Prerequisite: SER-010 Applications & Services (minimum: KID-CON-0109); Volume 1 and Volume 2 recommended
Purpose
Exposure as decision support—how organizations use exposure context, reachability, relationships, and intelligence to prioritize reduction, scope investigation, and communicate risk. Not vulnerability management administration, scanner configuration, or vendor product tours.
Educational flow: Volumes 1–3 (how analysts think + intelligence + entities) → How operations apply exposure reasoning
Authority anchors: KID-GLS-0007, KID-GLS-0035, KID-GLS-0036, KID-GLS-0037, KID-ARC-0001
Volume 4 pattern: Every article closes with Why this matters for security decisions.
Foundation for: SER-012 Correlation & Canonical Understanding
Reading order
| Order | KID | Article | Time |
|---|---|---|---|
| — | — | Prerequisite: SER-010; Volumes 1–2 recommended | — |
| 1 | KID-GLS-0007 | Exposure | 3 min |
| 2 | KID-CON-0110 | Understanding Security Exposure | 9 min |
| 3 | KID-CON-0111 | Exposure vs Vulnerability | 8 min |
| 4 | KID-CON-0112 | Exposure Context | 9 min |
| 5 | KID-GLS-0035 | Exposure Context (term) | 3 min |
| 6 | KID-CON-0113 | Exposure Prioritization | 9 min |
| 7 | KID-CON-0114 | Exposure Relationships | 9 min |
| 8 | KID-GLS-0036 | Attack Surface (term) | 3 min |
| 9 | KID-GLS-0037 | Attack Exposure (term) | 3 min |
| 10 | KID-CON-0115 | Unknown Exposure | 8 min |
| 11 | KID-CON-0116 | Exposure in Risk Decisions | 9 min |
| 12 | KID-CON-0117 | Exposure During Investigations | 9 min |
| 13 | KID-CON-0118 | Common Misconceptions About Exposure | 10 min |
| 14 | KID-GLS-0023 | Decision Support (term) | 3 min |
| 15 | KID-CON-0119 | Exposure as Decision Support | 10 min |
Practitioner questions answered
| Question | Primary KID |
|---|---|
| What is security exposure? | KID-CON-0110, KID-GLS-0007 |
| Is every vulnerability an exposure? | KID-CON-0111, KID-FAQ-0057 |
| Why does context change exposure meaning? | KID-CON-0112, KID-GLS-0035, KID-FAQ-0060 |
| How should exposure be prioritized? | KID-CON-0113, KID-FAQ-0058 |
| How do relationships and attack surface matter? | KID-CON-0114, KID-GLS-0036, KID-GLS-0037 |
| What about unknown or uncertain exposure? | KID-CON-0115 |
| How does exposure fit risk decisions? | KID-CON-0116 |
| How use exposure in investigation? | KID-CON-0117 |
| What mistakes do teams make? | KID-CON-0118 |
| Why is exposure decision support? | KID-CON-0119, KID-FAQ-0056 |
Glossary (series terms)
| KID | Term | Status |
|---|---|---|
| KID-GLS-0007 | Exposure | ✅ shared |
| KID-GLS-0035 | Exposure Context | ✅ new |
| KID-GLS-0036 | Attack Surface | ✅ new |
| KID-GLS-0037 | Attack Exposure | ✅ new |
| KID-GLS-0023 | Decision Support | ✅ shared (VOL-001) |
FAQs (attached)
| KID | Question | Primary parent |
|---|---|---|
| KID-FAQ-0056 | What is exposure? | KID-CON-0110 |
| KID-FAQ-0057 | Is every vulnerability an exposure? | KID-CON-0111 |
| KID-FAQ-0058 | How should exposure be prioritized? | KID-CON-0113 |
| KID-FAQ-0059 | Why does exposure change over time? | KID-CON-0113 |
| KID-FAQ-0060 | Why does exposure context matter? | KID-CON-0112 |
Not in scope (v1.0)
- Vulnerability scanner deployment and configuration
- Patch management workflow administration
- CVE database mechanics and CVSS deep dives
- Exposure management product comparisons
- Penetration testing tool tutorials
Knowledge debt (v1.0)
| ID | Component | Status |
|---|---|---|
| DEBT-S11-001 | Pillar hub PIL-EXPOSURE | ⏳ |
| DEBT-S11-002 | Concept map MAP-EXPOSURE-DECISIONS | ⏳ |
| DEBT-S11-003 | Learning path LP-011 formal INDEX | ⏳ |
| DEBT-S11-004 | D2 human review batch | ⏳ |
Collection statistics
| Asset type | Count |
|---|---|
| Educational articles | 10 |
| Glossary (series) | 3 |
| FAQ attachments | 5 |
| New KIDs | 17 |
| Cumulative KIDs | 218 |