gaelic-ghost/socket/assess-exposure-and-impact

Assess Exposure And Impact

Overview

Translate a technical finding into asset-specific risk and action. Treat CVSS as one technical severity input and current exploitation intelligence as another; neither replaces deployed context.

Read references/exposure-impact-model.md for the decision factors.

Workflow

1. Confirm finding confidence and exact affected/fixed versions.
2. Inventory affected assets.

• Record internet/internal/local reachability, environment, owner, business function, data, users, privileges, and compensating controls.

1. Model attacker requirements.

• Record access position, authentication, user interaction, configuration, chaining, reliability, and detection likelihood.

1. Check current intelligence.

• Review vendor advisory, fixed release, exploit maturity, CISA KEV/ransomware status, ecosystem advisories, and known active campaigns; date sources.

1. Evaluate consequence.

• Assess confidentiality, integrity, availability, privilege, blast radius, persistence, recovery difficulty, safety/legal/privacy obligations, and business interruption.

1. Evaluate mitigations.

• Test whether configuration, network controls, feature disablement, isolation, monitoring, or virtual patching actually blocks the validated path.

1. Prioritize action.

• Recommend patch, mitigate, isolate, monitor, accept temporarily with owner/expiry, or investigate further; include retest criteria.

Output

Return affected assets, exposure path, impact, current exploitation context, mitigations, priority/rationale, action owner/deadline, and residual uncertainty.