> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leveragecyber.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Vulnerability Exposure Categories: What Leverage Cyber Finds
> An overview of the five exposure categories Leverage Cyber detects and how each maps to measurable business risk and Annual Loss Expectancy.
Leverage Cyber organizes findings into five exposure categories, each representing a distinct attack vector that adversaries use to compromise organizations. Rather than presenting a flat list of vulnerabilities, this structure lets you understand the nature of each exposure, prioritize remediation by attack path, and communicate risk in business terms using Annual Loss Expectancy (ALE).
Leaked passwords, API keys, and identity data found in breach databases, paste sites, and dark web sources — the most direct path to account takeover.
Exposed admin panels, public cloud storage, overly permissive APIs, and development interfaces left accessible to the public internet.
Internet-facing ports and services that should not be publicly accessible — RDP, databases, management APIs, and legacy protocols.
Expired, misconfigured, and rogue TLS certificates that undermine trust, enable interception, and signal unauthorized infrastructure changes.
Return to the full external attack surface map — how all findings connect to your organization's digital footprint.
## Severity Levels
Every finding across all five categories is assigned one of four severity levels. Severity directly determines ALE, dashboard priority, and SLA for remediation guidance. The table below defines each level and its associated business impact range.
| Level | Color | ALE Range | Description |
| -------- | --------- | ------------- | ------------------------------------------------------------------- |
| Critical | 🔴 Red | > \$1M/yr | Actively exploitable, high-value target, immediate action required |
| High | 🟠Orange | $250K–$1M/yr | Significant exposure, exploit path exists, remediate within 60 days |
| Medium | 🟡 Yellow | $50K–$250K/yr | Notable exposure, moderate attack complexity, plan remediation |
| Low | 🔵 Blue | \< \$50K/yr | Minor exposure, low exploitability, address in planning cycle |
ALE figures represent the statistically expected annual financial loss if the exposure is left unaddressed. These figures account for both the probability of exploitation and the estimated impact of a successful breach, adjusted for your organization's asset criticality and industry sector.
## How Findings Are Scored
Leverage Cyber does not rely on a single metric to assign severity. Each finding is scored using a composite model that weighs five inputs:
* **CVSS Base Score** — the technical severity of the underlying vulnerability, independent of your environment
* **EPSS (Exploit Prediction Scoring System)** — a machine-learning probability score indicating how likely a vulnerability is to be exploited in the wild within the next 30 days
* **KEV (CISA Known Exploited Vulnerabilities)** — whether the vulnerability appears on CISA's authoritative list of actively exploited CVEs, which automatically elevates severity
* **Asset Criticality** — the business importance of the affected asset, determined during onboarding and refined through continuous monitoring
* **Business Context** — industry vertical, regulatory exposure, and prior incident history, which adjust the financial weight of each finding
This composite approach means a medium CVSS score vulnerability on a customer-facing payment system may be rated Critical in your environment, while the same finding on an isolated internal test asset may remain Low. Severity is always contextual, never generic.
## Finding Lifecycle
Every finding moves through a defined set of states from initial detection to closure. These states are tracked in the Leverage Cyber dashboard and each transition updates your organization's aggregate ALE in real time.
| State | Description |
| ------------------ | ------------------------------------------------------------------------------------------------- |
| **New** | Finding detected for the first time; not yet reviewed by your team |
| **Acknowledged** | Your team has reviewed the finding and confirmed it is valid |
| **In Remediation** | Active work is underway to resolve the exposure |
| **Resolved** | The remediation action is complete; Leverage Cyber has verified the exposure is no longer present |
| **Closed** | Finding is closed, either resolved or accepted as a known risk with documented justification |
State transitions are logged with timestamps and optional notes, creating an audit trail for compliance reporting. When a finding moves to **Resolved**, Leverage Cyber re-checks the asset against its passive data sources to confirm the exposure is gone before removing its ALE contribution from your dashboard totals. Risk-accepted findings remain visible in the **Closed** state and contribute a discounted ALE value to reflect the residual risk.
Findings across different categories can be correlated into compound risk chains. A low-severity credential exposure finding — for example, a hashed password from an older breach — may appear manageable in isolation. Combined with an open RDP port on the same domain and a missing MFA policy, that same finding becomes part of a complete ransomware entry path and should be treated as Critical. Leverage Cyber surfaces these correlations automatically in the Risk Chains view of your dashboard.