# Assess Exposure And Impact

> Prioritize a vulnerability using actual asset exposure and impact. Use when versions, reachability, prerequisites, privileges, data, exploit maturity, mitigations, detection, business criticality, and urgency matter beyond CVSS.

- Skill: `gaelic-ghost/assess-exposure-and-impact` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add gaelic-ghost/assess-exposure-and-impact`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gaelic-ghost/assess-exposure-and-impact/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: gaelic-ghost (https://skillmd.com/u/gaelic-ghost)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gaelic-ghost/assess-exposure-and-impact

---


# Assess Exposure And Impact

## Overview

Translate a technical finding into asset-specific risk and action. Treat CVSS as one technical severity input and current exploitation intelligence as another; neither replaces deployed context.

Read [references/exposure-impact-model.md](references/exposure-impact-model.md) for the decision factors.

## Workflow

1. Confirm finding confidence and exact affected/fixed versions.
2. Inventory affected assets.
   - Record internet/internal/local reachability, environment, owner, business function, data, users, privileges, and compensating controls.
3. Model attacker requirements.
   - Record access position, authentication, user interaction, configuration, chaining, reliability, and detection likelihood.
4. Check current intelligence.
   - Review vendor advisory, fixed release, exploit maturity, CISA KEV/ransomware status, ecosystem advisories, and known active campaigns; date sources.
5. Evaluate consequence.
   - Assess confidentiality, integrity, availability, privilege, blast radius, persistence, recovery difficulty, safety/legal/privacy obligations, and business interruption.
6. Evaluate mitigations.
   - Test whether configuration, network controls, feature disablement, isolation, monitoring, or virtual patching actually blocks the validated path.
7. Prioritize action.
   - Recommend patch, mitigate, isolate, monitor, accept temporarily with owner/expiry, or investigate further; include retest criteria.

## Output

Return affected assets, exposure path, impact, current exploitation context, mitigations, priority/rationale, action owner/deadline, and residual uncertainty.