An exposure inventory is a systematic check of every deployed instance of a system, service, or application to identify which assets are still exposed to a known risk and need remediation. In practice, it means more than checking production: teams also review test, standby, replica, container, and self-managed installations that may have been forgotten after deployment or scaling.
This matters because attackers often target the weakest or least visible instance, not the main one. A patched primary server does not help if an older replica remains reachable with the vulnerable version. Defenders use exposure inventories to prioritize patching, confirm scope, and verify that mitigations reached all environments. In real incidents, this step helps close the gap between a vendor fix and actual security by finding overlooked systems before they can be abused.