Exposure

Openlane's Exposure module connects risk themes to real security work: scans, vulnerabilities, findings, and remediations. Technical findings get prioritized by business impact rather than tracked equally, and the chain from risk to remediation is one auditors can follow end to end. Several of the terms used in this section are often incorrectly used interchangeably. They mean different things, and the distinctions drive how each is handled:

Threat

A person, event, or condition capable of causing harm, whether natural (an earthquake, an outage) or human (an attacker, a careless insider). Threats exist whether or not you do anything about them.

Vulnerability

A weakness in a system, procedure, or control that a threat could exploit. A vulnerability is a condition, not an outcome: it describes what is exploitable, not what has happened.

Risk

The exposure that results when a threat could exploit a vulnerability against something you value, assessed by how likely that is and how bad it would be. Risk is what you score, prioritize, and treat.

At a high level, threats exploit vulnerabilities, and that exposure is risk. Controls reduce it by preventing, detecting, or correcting; when controls are absent or fail, incidents happen.

These records interconnect rather than flow in one direction. Scans link to the assets and entities they cover; vulnerabilities and findings reference the scans that surfaced them and link directly to risks; remediations connect to the findings, vulnerabilities, scans, and risks they address. Each page in this section describes one record and the connections it carries.

What's in This Section

• Risks - Define and prioritize business and security risks
• Scans - Track scan cadence, execution, and coverage context
• Vulnerabilities - Manage known weaknesses and remediation SLAs
• Findings - Track observed issues from tooling and reviews
• Remediations - Document and verify corrective actions