Exposure Analysis
Last Updated: September 28, 2026
Estimated Reading Time: 4 minutes
Overview
Exposure Analysis shows what else a CI can reach through CMDB relationships. Use it when a CI is compromised, misconfigured, or under a security or tabletop review.
Exposure Analysis and the Blast Radius Simulator answer different questions:
| Blast Radius (outage) | Exposure Analysis | |
|---|---|---|
| Question | If this CI fails, what depends on it? | If this CI is compromised, what is connected to it? |
| Direction | From the CI to its dependents | Both directions |
| Relationships | Only outage-propagating relationships | All normalized relationships, including relationships that do not carry outage impact |
The two modes use separate, versioned relationship rules. The same CI usually gives different counts in each mode.
Exposure Analysis shows CMDB relationship reachability. It does not verify network paths, identity permissions, or an exploit path. Use it to scope a review, not to prove that an attack is possible.
How to Run Exposure Analysis
- Go to Dependency Map.
- Find the CI. Use search or the map.
- Right-click the CI.
- Select Exposure Analysis.
- Review the results in the Exposure Analysis side panel.
Exposure Analysis runs against the current CMDB mirror. If Time Machine shows historical topology, return to live topology first.
Results
- Direct exposure is one relationship level from the selected CI.
- Indirect exposure is reached through more levels.
- The map shows only the CIs that connect to the selected CI through the returned relationships.
- Exposure Analysis Evidence shows the paths, the included relationships, the excluded relationships, and the limits of the analysis.
Like the Blast Radius Simulator, Exposure Analysis reports evidence confidence and completeness. Stale topology or an early stop lowers confidence.
How to Export Results
- Run Exposure Analysis.
- Select Export PDF or Export CSV.
CMDBx creates the export from the saved result. The export does not run the analysis again.
How to Use Exposure Analysis
Security Incident Scoping
- Run Exposure Analysis on the affected CI.
- Review the direct exposure first.
- Share the CSV with the security team to scope the investigation.
Tabletop Exercises
- Select a critical CI, for example an identity provider or a shared database.
- Run Exposure Analysis.
- Review which services connect to the CI.
- Record gaps where the CMDB does not model a relationship that you expect.