Exposure assessment is the process of identifying where a threat could affect systems, services, people, or operations. It connects potential threats to the assets and business activities they could disrupt, including dependencies on suppliers and technology platforms.
In cyber security, this helps organizations decide what to address first based on likely impact and existing safeguards. For example, a bank can map critical services to the systems that support them, identify relevant weaknesses or threat scenarios, and prioritize remediation or recovery planning. The assessment should be revisited as systems, dependencies, and threats change, and its findings can help leaders make informed decisions about risk and resilience.