Assess Exposure And Impact
Overview
Translate a technical finding into asset-specific risk and action. Treat CVSS as one technical severity input and current exploitation intelligence as another; neither replaces deployed context.
Read references/exposure-impact-model.md for the decision factors.
Workflow
- Confirm finding confidence and exact affected/fixed versions.
- Inventory affected assets.
- Record internet/internal/local reachability, environment, owner, business function, data, users, privileges, and compensating controls.
- Model attacker requirements.
- Record access position, authentication, user interaction, configuration, chaining, reliability, and detection likelihood.
- Check current intelligence.
- Review vendor advisory, fixed release, exploit maturity, CISA KEV/ransomware status, ecosystem advisories, and known active campaigns; date sources.
- Evaluate consequence.
- Assess confidentiality, integrity, availability, privilege, blast radius, persistence, recovery difficulty, safety/legal/privacy obligations, and business interruption.
- Evaluate mitigations.
- Test whether configuration, network controls, feature disablement, isolation, monitoring, or virtual patching actually blocks the validated path.
- Prioritize action.
- Recommend patch, mitigate, isolate, monitor, accept temporarily with owner/expiry, or investigate further; include retest criteria.
Output
Return affected assets, exposure path, impact, current exploitation context, mitigations, priority/rationale, action owner/deadline, and residual uncertainty.
1---2name: assess-exposure-and-impact3description: Prioritize a vulnerability using actual asset exposure and impact. Use when versions, reachability, prerequisites, privileges, data, exploit maturity, mitigations, detection, business criticality, and urgency matter beyond CVSS.4---56# Assess Exposure And Impact78## Overview910Translate a technical finding into asset-specific risk and action. Treat CVSS as one technical severity input and current exploitation intelligence as another; neither replaces deployed context.1112Read [references/exposure-impact-model.md](references/exposure-impact-model.md) for the decision factors.1314## Workflow15161. Confirm finding confidence and exact affected/fixed versions.172. Inventory affected assets.18 - Record internet/internal/local reachability, environment, owner, business function, data, users, privileges, and compensating controls.193. Model attacker requirements.20 - Record access position, authentication, user interaction, configuration, chaining, reliability, and detection likelihood.214. Check current intelligence.22 - Review vendor advisory, fixed release, exploit maturity, CISA KEV/ransomware status, ecosystem advisories, and known active campaigns; date sources.235. Evaluate consequence.24 - Assess confidentiality, integrity, availability, privilege, blast radius, persistence, recovery difficulty, safety/legal/privacy obligations, and business interruption.256. Evaluate mitigations.26 - Test whether configuration, network controls, feature disablement, isolation, monitoring, or virtual patching actually blocks the validated path.277. Prioritize action.28 - Recommend patch, mitigate, isolate, monitor, accept temporarily with owner/expiry, or investigate further; include retest criteria.2930## Output3132Return affected assets, exposure path, impact, current exploitation context, mitigations, priority/rationale, action owner/deadline, and residual uncertainty.
gaelic-ghost