You can't patch your way out of exposure.

“What matters enough to defend?”

Define the exposure surface in business terms, not asset inventories. Scoping decides which attack surfaces the cycle will cover this round: external-facing systems, SaaS posture, identity infrastructure, a crown-jewel business service.

• Start narrow and business-aligned. A first scope of “everything internet-facing that touches customer data” beats “the whole enterprise” — the cycle has to complete to be continuous.
• Involve business owners here, not just security. If the scope can't be explained to a VP in one sentence, it's an engineering scope, not an exposure scope.
• Each cycle can expand: external attack surface first, then SaaS and identity, then internal segments and cloud workloads.

“What actually exists inside that scope?”

Enumerate assets, misconfigurations, identities, and vulnerabilities within the scope — including the ones nobody registered. Discovery is where shadow IT, forgotten subdomains, stale DNS, and over-permissioned service accounts surface.

• Discovery is broader than vulnerability scanning: it includes misconfigurations, exposed credentials, risky identity paths, and third-party exposure — not just CVEs.
• Expect the asset count to disagree with the CMDB. That disagreement is a finding, not a data-quality annoyance.
• Volume here is normal and unthreatening; the next stage exists precisely because you will discover more than you can fix.

“Which exposures would an attacker actually use?”

Rank exposures by exploitability, threat activity, compensating controls, and blast radius toward critical assets — not by CVSS base score. The output is a short list the organization can genuinely act on.

• CVSS answers “how bad could this be in the abstract.” Prioritization asks “is this reachable, is it being exploited in the wild (KEV/EPSS), what does it chain to, and what controls already stand in the way.”
• Attack-path context changes everything: a medium-severity misconfig that bridges to domain admin outranks a critical CVE on an isolated dev box.
• A useful test: if the prioritized list is longer than what remediation teams can plausibly clear in a cycle, prioritization hasn't happened yet.

“Can it really be exploited here — and would we notice?”

Prove or disprove the prioritized exposures under real conditions: can the attack path be traversed, do existing controls block or detect it, and how far does it go? Validation converts assumed risk into evidence.

• Techniques range from breach-and-attack simulation (BAS) and automated pentesting to targeted red-team exercises — Gartner clusters these as adversarial exposure validation (AEV).
• Validation cuts both ways: it deflates paper-critical findings that controls already neutralize, and it escalates “low” findings that chain into real paths.
• It also tests response: an exploit that succeeds silently is two findings — the exposure and the detection gap.

“Who fixes it, and what removes the friction?”

Drive remediation through the people who own the systems. Mobilization is the operational and political stage: pre-negotiated workflows, clear ownership, tracked SLAs, and reporting the business understands.

• This is where most programs stall. Findings without pre-agreed remediation paths become tickets that age; mobilization means the workflow, approver, and SLA were agreed before the finding arrived.
• Not everything mobilizes to a patch — compensating controls, segmentation, decommissioning, and formally accepted risk are all valid closures.
• Report in exposure-reduction terms (“attack paths to payment systems cut from 14 to 3”), not ticket counts. Then re-scope and run the cycle again.