ESIP watches public evidence about how vulnerabilities are being exploited, detects when that picture changes, and turns the change into a verdict you can act on. This page explains the mechanism. For what an exposure signal is, see the definition.
ESIP produces the verdict. You make the decision.
A CVE's base score is set near disclosure and rarely moves. The exploitation state underneath it does not sit still: a proof of concept appears, an exploit is weaponized, a government catalog confirms it in the wild, a patch ships. The score cannot tell you any of that happened. ESIP is built to.
ESIP draws only on globally observable evidence: public sources anyone can check, never your environment. They group by the job they do.
13 ingested sources, enumerated above; the count is the sum of the list, not a figure asserted on its own. MITRE ATT&CK is applied as a mapping framework for attack relevance, separate from the ingested sources.
When something qualifying happens in one of those sources (a proof of concept lands, an exploit is weaponized, a CVE is added to KEV, a prediction score moves materially), ESIP records it as an observed change event: dated, attributed to its source, with a navigable reference to the artifact itself. These observed changes are the inputs, not the verdict.
ESIP rolls the active changes for an exposure class into one verdict, across four dimensions you can query on their own:
Alongside the verdict sits the evidence narrative: what changed, and why ESIP reached this reading. A verdict moves only when the exploitation state materially moves; it stays quiet otherwise.
A signal is not a permanent label. It fires the moment strong evidence arrives, and it fades as that evidence ages, on a clock that differs by evidence type: confirmed exploitation stays relevant far longer than a single day's prediction move. The transitions are deliberately asymmetric. Strong evidence pulls a signal up at once; only decay brings it down, so the verdict does not flicker every time one observation comes and goes. Decay lowers influence. It does not erase history: a faded signal still leaves its record, and fresh evidence wakes it.
Every verdict traces to the public evidence under it, and the same evidence under the same rules always produces the same verdict. That is what lets you defend a decision months later, to an auditor or a board. The full integrity argument (provenance, determinism, reproducibility) lives on its own page.
Why you can rely on it →This page describes how ESIP implements exposure signals. The term itself is defined in the reference. For how ESIP sits alongside your scanner, your VM platform, and your CTEM program, see where it fits.