What is an exposure signal?

Definition version 1.0.0 · Published 2026 · Status: Stable
Source: Exposure Signals: A Practical Definition and Reference Model for Vulnerability and Exposure Management, v1.0.0

An exposure signal is a deterministic, time-aware, evidence-backed assessment of an exposure class's exploitation state, derived from globally observable evidence.

Exposure Signals: A Practical Definition and Reference Model for Vulnerability and Exposure Management, v1.0.0

An exposure signal describes an exposure class, not your organization's assets.

A class-level assessment of a security condition that exists independently of any asset, with local asset context left to the consumer. The term is used inconsistently across the industry; some apply "exposure signal" to an asset-level combination of conditions on one system. ESIP means something different, and more reusable: a class-level assessment that means the same thing for everyone.

• Exposure signals exist because exploitation state changes over time.
• Changes in globally observable evidence produce changes in exposure state, expressed as exposure signals.
• An exposure signal describes an exposure class, not your organization's assets.
• Exposure signals are class-level assessments. They inform prioritization decisions but are not prioritization decisions, and they do not establish whether a specific organization is affected. That requires local asset context.

Deterministic

The same evidence under the same rules always produces the same assessment. Reproducible and replayable, not a number that wanders.

Time-aware

The assessment knows when it last moved and ages as its evidence ages. This is the clause that carries change.

Evidence-backed

Every verdict traces to its source. Strip the evidence and what is left is an opinion.

Exposure class

The stable unit a signal describes (a CVE is the archetype), not your asset.

Globally observable evidence

Public sources, not your environment: exploitation catalogs, exploit repositories, prediction scores, patch status.

Exploitation state means the current observable state of an exposure class, as determined by exploitation capability, exploitation activity, predicted exploitation likelihood, attack relevance, and remediation availability. Read it everywhere as defined here, not as attacker activity alone; a patch becoming available is a real change in that state.

The canonical definition is intended to remain stable over time. Clarifications may be added through revision, but changes to the meaning of the term are expected to be rare.

The "is not" column names the asset-level usage explicitly: an exposure signal is class-level, the same for everyone, not a combination of risks on one of your assets.

Five words that get blurred.

Threat signal pulls toward threat intelligence, with its actors and intent, which this model sets aside. Risk signal borrows from risk scoring, which folds in business impact the model does not carry. Exposure event names the raw change, not the published assessment. Exposure signal is the fit: exposure, because it describes the exposure class, and signal, because it is the interpreted, evidence-backed assessment of change.

See it on a real CVE.