Exposure
See every target in your engagements' scope, its observed surface and its open findings, including a browsable inventory for cloud accounts.
Overview
Exposure is the in-scope counterpart to Surface Intelligence. It lists every target inside an engagement's scan scope (web hosts, cloud accounts, LLM endpoints and secrets sources), grouped by engagement under Web App, Cloud, LLM and Secrets bands.
Open it from Pentests > Exposure. Use it to see what a target looks like from outside, what is open against it on the delivery boards, and, for cloud accounts, which resources are exposed and who can reach them.
KPI tiles
| Tile | Counts |
|---|---|
| Monitored targets | Targets in scope, and how many engagements they belong to. |
| At critical risk | Targets with an open critical finding on a board. |
| Critical findings | Open critical findings on the boards. |
| With open findings | Targets with at least one open finding. |
| Total findings | Open findings on the boards (closed ones are not included). |
| Closed | Findings resolved on the boards. |
Press a tile to narrow the list to matching targets. Finding counts come from the live board cards.
Work a target
- Open Pentests > Exposure.
- Narrow the list with the search box, the engagement picker, a KPI tile, or filters: Target name, Kind, Risk, Org, Tech, Port, CVE and IP.
- Select a target to open its detail panel.
- Use the header buttons: Open on board (N) opens the board holding most of its findings, Scan now opens the run dialog (see Run and schedule scans) and reads Cancel scan while a scan runs, and Engagement config opens the engagement's settings.
The detail panel has these tabs:
| Tab | Shows |
|---|---|
| Surface intelligence | The target's observed surface. Web targets show Components, CVEs matched, Open ports, TLS expiry, First scan and Last scan, plus the same recon sections as Surface Intelligence. Cloud accounts show their inventory (below). |
| Findings | The target's findings on the boards. |
| Attack chains | Coming soon. The tab currently always reads No chains detected yet. |
To add a target, add it to an engagement's scope. Add engagement in the page header takes you to Manage > Engagements.
Findings on a target
The Findings tab lists ID, Finding, Severity, Status and Assignee. Click a column header to sort. Click a row to open its card, or Open all N on the board → to see them all on the board.
Related findings fold into one row. In a cloud account, the same issue found in several regions shows once, with the worst instance on top and a +N control. Press it to show the rest (each labelled by region) and Fewer to fold them again.
Cloud accounts
A cloud account shows Resources in scope, Regions scanned, Publicly accessible, Pass rate, First scan and Last scan, and two ways into its inventory.
- Hotspots lists publicly accessible resources, worst first.
- Services & Resources lists every resource, grouped by Service, Category, Region, Severity or Compliance.
Click a resource to see when it was First seen and Last confirmed, its metadata, its Open Findings · N and its Flow Graph.
Flow Graph
The Flow Graph shows the resource's direct relationships, one hop out, in lanes:
| Lane | Shows |
|---|---|
| PART OF / INSIDE | What the resource belongs to or sits in. |
| PARTS · <type> / CONTAINS · <type> | Its own parts and contents, by resource type. |
| HELD BY, ROLE, ON | Access grants: who holds access, through which role, on what. Anyone (public) marks public access. |
Grants through provider-managed roles are collapsed into Provider-managed · N. Turn on Include provider-managed role grants (N) to show them. Click any node to move to that resource.
Lanes show four rows and load more as you scroll. Lists over 20 items load in pages.
Permissions
| To | You need |
|---|---|
| Open the page, including cloud inventory | Pentest > Exposure: Read |
| Start or cancel a scan | Pentest > Exposure: Write, or Write on the engagement's type |
See Team and permissions.
Good to know
- A host appears on one page, not both. In an engagement's scope, it is on Exposure; out of scope, it is on Surface Intelligence.
- LLM endpoints and secrets sources show their findings, but some coverage stats (such as Probes run or Commits scanned) are not reported yet and show a dash.
- Cloud inventory status can read Inventory queued, Inventory running, Inventory is temporarily unavailable or Cloud inventory is not offered in this workspace's region yet.
- Cloud access that PENOPS reads from your account is set up in Cloud permissions.