Exposure Risk Factor
Every identity's risk score includes its own open Security Posture findings, set by the most severe one.
Requires role: Operator or Admin
Related: Risk Posture Dashboard, Cross-Tier Credential Exposure, Account Security & Credential Hygiene Checks, Identity Inventory, Asset Criticality
Overview
After every sync, GraphnAI runs its library of Security Posture checks against your environment: credential hygiene, stale privileged accounts, certificate services settings, naming-attribute tampering and more. The Exposure factor carries those findings into each identity's risk score. It's one of nine risk factors, worth 10% of the score.
Exposure reflects the identity's worst open finding. An account with a Critical credential-hygiene finding shows up as high risk in the same score you use for prioritization, reports and Select Fire triage.
On the Risk Posture Dashboard, the Exposure card sums up the whole posture library, including Tier 0 credential exposure. It's the dashboard's way into the Security Posture page.
Prerequisites
- Role: Operator or Admin. Viewers don't see the risk breakdown, the Risk Posture Dashboard or the Security Posture page.
- Data: At least one successful sync and one completed analytics run after it, as for the rest of the Risk Posture Dashboard.
- Security Posture has run on the connector: Exposure reads findings only from an analytics run whose posture step finished for that identity's connector. Until then, every identity there shows Exposure as not observed yet, never zero. See Reading coverage.
- Session telemetry, for the cross-tier credential exposure check. See Cross-tier credential exposure check.
How the Exposure factor is scored
Exposure is set by the single worst open finding against the identity. It isn't a running total. A Critical finding sets the factor to its maximum, however many other findings are open.
| Severity of the worst open finding | Factor value | Points added to the risk score (at 10% weight) |
|---|---|---|
| Critical | 100 | +10 |
| High | 70 | +7 |
| Medium | 40 | +4 |
| Low | 10 | +1 |
| No open findings | 0 | +0 |
Two things follow from this:
- Volume doesn't add up. Six High findings on one identity score the same as one High finding. A pile of low-severity configuration debt can't outrank one serious issue.
- The score moves when the worst finding closes. An identity with eight open Medium findings keeps the same score after you close seven. Closing the last one drops the factor to zero.
The finding count still shows wherever Exposure appears. For example, a top finding's detail reads "14 open exposure findings, worst High", so you can tell one stubborn issue from a backlog.
Where it shows up
Risk breakdown
Select an identity's risk score badge to open its Risk breakdown. This works in the Identity Inventory, the dashboard's Top findings and anywhere else a risk score appears. Exposure is one of the factor rows, showing its points out of 10, such as "7.0 of 10".
When Exposure isn't observed yet for that identity, the row shows a dash in place of the points. Hover it to read "Exposure isn't observed yet for this identity. It's left out of the score until it is." See Reading coverage.
Risk Posture Dashboard
The Exposure card shows a score, the worst severity, finding counts and a trend, like its neighbors. By default it's 5% of the dashboard's composite score. Select it to open the Security Posture page, where the findings are.
The Security Posture page shows its own letter grade at the top. The dashboard doesn't repeat it, so the Exposure card is the dashboard's one number for posture.
Weight dialog
Select the settings gear on the dashboard to adjust the dashboard's factor weights. The Exposure slider sits in the Posture health group, with Staleness and Delegation risk. The dialog has eight sliders in all. These weights shape the dashboard's composite score only. An identity's own risk score uses the fixed weights in Factor weights.
Security Posture page
Exposure > Security Posture holds the findings behind the Exposure number: every check, its result per connector, and how to fix each failing one. See Account Security & Credential Hygiene Checks for the largest category of checks.
Reading coverage
GraphnAI keeps "not checked yet" apart from "checked and clean".
Per identity: If Security Posture hasn't run on an identity's connector in the current analytics run, its Exposure row shows a dash. Once posture runs on that connector, the row shows a real value: zero if nothing was found, or the worst finding's value.
On the dashboard: The Exposure card has three coverage states. Hover its coverage dot to read the state and its reason.
- Full coverage: every applicable identity was measured. The score stands as shown.
- Partial coverage: some checks didn't run or some identities couldn't be read, so the real exposure could be higher, never lower. The reason names the connector, for example "18 of 20 posture checks haven't run on corp.example.com." or "Security Posture hasn't run on lab.example.com since the last sync."
- Not yet observed: posture has never finished on the included connectors. The card shows a dash in place of a score, and its weight isn't counted in the overall grade until posture runs.
Checks that don't apply to a connector don't count either way. For example, Active Directory checks aren't expected to run on an Entra ID tenant, so an Entra tenant reads as fully covered once its own checks run.
Cross-tier credential exposure check
Tier 0 credential exposure is one check in the posture library. A lower-tier account can take a Tier 0 credential from a computer where a Tier 0 session was seen. The check is in the Cross-tier exposure category, with Critical severity. Its evidence is observed telemetry, so its findings carry the highest evidence level, Validated.
The check needs session telemetry on the connector: Windows event 4624 (successful sign-in) and event 4672 (special privileges assigned). On a connector without it, the check reads Not assessed and names the missing input. That counts toward the connector's Exposure coverage like any other check that couldn't run. It doesn't drop the connector's Exposure score to zero, and it isn't silently skipped.
Each finding names the computers the credential was seen on and the identities that can take it there. See Cross-Tier Credential Exposure for how to read and act on one.
Disabled accounts
Five account-flag checks look only at enabled accounts:
- Account without Kerberos pre-authentication
- Account storing its password with reversible encryption
- Account restricted to DES encryption
- Account exempt from the password requirement
- Smartcard account with a password hash that never changes
A disabled account with one of these flags has no open finding, because nobody can use the flag until the account is enabled again.
If a disabled account is enabled again and still has the flag, the finding opens on the next analytics run with a new first-seen date. It reads as open since the account was enabled again.
Factor weights
An identity's risk score uses these fixed weights:
| Factor (as the risk breakdown shows it) | Weight |
|---|---|
| Permission load | 18% |
| Criticality gap | 18% |
| Junction score | 13% |
| Alert severity | 13% |
| Staleness | 13% |
| Exposure | 10% |
| Administrative tier | 5% |
| Group nesting | 5% |
| Empty group | 5% |
When Exposure was added, the five heaviest factors each gave up 2 points to fund it. That moved every identity's score once, even for identities with no findings. Some identities moved from one risk level to another with no change in their access.
Trend history
The dashboard's trend chart and each identity's risk history show only scores from the nine-factor model. Earlier snapshots, from the eight-factor model, don't appear. Mixing the two on one line would misstate whether risk went up or down.
Analytics timing
Security Posture runs before the identity inventory step in the analytics after a sync, so the inventory reflects the same posture results as the Exposure factor. The inventory refresh after a sync appears a little later as a result. In testing on about 911,000 identities, the posture step took about two and a half minutes. Smaller environments take proportionally less.