Key takeaways

• Exposure assessment decides which findings are reachable, unprotected, connected to critical assets and owned by someone who can fix them.
• JPMorganChase's November 2026 guidance says AI has sped up vulnerability discovery and exploitation, while remediation has not kept pace.
• The bottleneck is no longer finding vulnerabilities. It is assessing them in context fast enough to act.
• Exposure assessment is relationship work, so it is best done on a graph of assets, identities, controls and owners.
• You do not need to replace your scanners. Assessment adds context on top of their findings.

On November 2, 2026, JPMorganChase's Global Technology Leadership Team published 200 days into the frontier, a follow-up to its April guidance, 10 actions to take now for AI-ready cyber resilience. Together, the two posts make a case that discovery is no longer the hard part of security. Exposure assessment is.

What is exposure assessment?

Exposure assessment is the practice of deciding which security weaknesses actually create risk by evaluating each one in context: whether it is reachable, whether controls protect it, what it connects to and who owns it. It turns a list of findings into a ranked set of exposures teams can act on.

A vulnerability is a flaw. An exposure is that flaw on an asset an attacker can reach, without working compensating controls, near something that matters. Gartner recognized the discipline as its own market in 2025 with the first Magic Quadrant for Exposure Assessment Platforms, which replaced its guide to vulnerability assessment.

Why has AI made exposure assessment the bottleneck?

AI has made vulnerability discovery and attack automation much faster, but it has not made remediation faster. Teams now face more findings, arriving sooner, with less time before exploitation, so the slow step is deciding which ones matter and who must fix them.

JPMorganChase names this directly. It separates decision speed from execution speed: a company can decide in hours and still need weeks to identify affected systems, find owners and confirm fixes. Its April guidance sets the target of answering "where are we exposed?" in minutes, not days.

What does JPMorganChase recommend for AI-era cyber resilience?

JPMorganChase recommends three moves for CEOs: change assumptions about tolerable risk, shorten decision cycles, and build resilience that is proven by testing. Each action ends with leadership asking for evidence rather than reassurance.

The actions most relevant to exposure assessment are:

• Treat unsupported and end-of-support technology as a time-bound business liability.
• Know what is directly reachable from the internet, and reduce that exposure.
• Keep a continuously updated asset inventory enriched with ownership, criticality and exposure.
• Prioritize vulnerabilities by criticality, reachability, threat intelligence and the CISA Known Exploited Vulnerabilities catalog.
• Remove standing privileges and limit what AI agents and machine identities can reach.
• Predefine who can isolate an exposed service when no fix is available.

How do you assess whether an exposure matters?

Assess every finding against four questions: Is it reachable? Is it protected by working controls? What does it connect to? Who owns it? A critical CVE that fails all four outranks the same CVE behind an authentication layer on an isolated test system.

• Reachability: internet-facing, or one hop away through an identity or network path.
• Control coverage: EDR, MFA on privileged access, segmentation and egress filtering actually in place on that asset.
• Blast radius: the identities, data and critical services the asset can reach.
• Ownership: an accountable team the fix can route to today.

How does JupiterOne assess exposure?

JupiterOne assesses exposure on a graph that connects every asset, identity, control, finding and owner, so the four questions above become queries instead of manual reconciliation. It runs in five steps.

1. Scope. Build a continuous inventory from agentless integrations across cloud, endpoints, identity, code and SaaS, including unsupported systems and their owners.
2. Ingest. Bring in findings from the scanners you already run. JupiterOne is scanner-agnostic, so nothing is re-scanned.
3. Contextualize. Attach internet exposure, identity paths, blast radius and CISA KEV status to every finding. The Emerging Threats feed connects new threats to affected assets.
4. Control check. Use continuous controls monitoring on the same graph to see whether the vulnerable asset has EDR, MFA-protected access and restricted egress.
5. Mobilize and prove. Route fixes to the asset's owner and confirm closure with a continuous control.

What happens in the first hour of a critical CVE?

With exposure assessment in place, the first hour produces a list of affected assets ranked by reachability and control coverage, each with an owner. Without it, the first hour is spent reconciling tools.

Take an illustrative case: a critical VPN gateway flaw is disclosed on a Tuesday morning. The Emerging Threats feed flags it, and one query returns every affected gateway, which are internet-facing, what sits behind each and who owns it. Gateways behind an independent authentication layer drop in priority. Two exposed gateways with no compensating control rise to the top and are isolated, as JPMorganChase's guidance on predefined isolation authority recommends. A control turns green once no exposed, unpatched instance remains.

Exposure assessment vs. vulnerability scanning

Vulnerability scanning finds flaws; exposure assessment decides which flaws create real risk. Most enterprises need both, with assessment sitting on top of scanner output.

How do you start an exposure assessment program?

Start with what you already own: connect existing tools, build a live inventory, then add context and controls in layers. Most teams can complete the first pass in about a month.

1. Connect your existing security and IT tools and establish a live asset inventory.
2. Flag unsupported and internet-facing assets, with an owner on each.
3. Bring in findings from every scanner and rank them by reachability, KEV status and business criticality.
4. Add control checks: MFA on privileged access, EDR coverage, restricted egress and patch SLAs on internet-facing assets.
5. Report exposure aging, remediation velocity and open exceptions to leadership.

Frequently asked questions

Is exposure assessment the same as CTEM? No. Continuous threat exposure management (CTEM) is the overall program, usually described in five stages: scoping, discovery, prioritization, validation and mobilization. Exposure assessment platforms are the tools that support it, mainly the discovery and prioritization stages.

What is an exposure assessment platform? An exposure assessment platform continuously identifies and prioritizes exposures, such as vulnerabilities and misconfigurations, across many asset classes. It either scans natively or ingests results from assessment tools, then ranks exposures using threat, business and security control context.

Do I need to replace my vulnerability scanner? No. Scanners find flaws; exposure assessment decides which ones matter. JupiterOne ingests findings from tools such as Tenable, Qualys and Rapid7 and adds the asset, identity, control and ownership context they lack.

How does CISA KEV fit into exposure assessment? The CISA Known Exploited Vulnerabilities catalog flags flaws attackers are actively using. It is one input to prioritization, and it is most useful when combined with reachability and control coverage, as JPMorganChase's guidance recommends.

How fast should a security team know where it is exposed? JPMorganChase's guidance sets the target at minutes, not days, after a new threat emerges. Meeting it requires an inventory that already carries ownership, exposure and criticality before the incident starts.

How does exposure assessment help with AI agents? AI agents act through identities. Assessing exposure on a graph shows which systems and data each agent or machine identity can reach, which supports JPMorganChase's advice to limit agent access to the task.

The bottom line

The organizations that will succeed will reduce accumulated risk, decide faster and recover before disruption becomes a crisis, and none of that happens unless exposure assessment keeps pace with discovery.

‍

_{JupiterOne is not affiliated with JPMorganChase or Gartner. References are to publicly available guidance and research.}