← Exposures · the misconfiguration (M) surface across OS, Identity, and Data
Configuration exposure
Exposure as control gaps and misconfiguration — where your defenses structurally miss, where host and cloud posture drift, and the weakness classes that are really authorization and configuration mistakes. Same rigor as the CVE lens, applied to the configuration layer.
Last updated: 12 August 2026 00:47 UTC . Analysis from public framework and vulnerability data — not a posture-scanning product.
Control gaps by actor
For each of the most active actors, the NIST 800-53 controls that mitigate the largest share of their ATT&CK techniques — and how much of their playbook even the best single control leaves uncovered.
| Actor | Start-here controls | Best coverage | Uncovered share |
|---|---|---|---|
| Kimsuky171 techniques | SI-4CM-6CM-2 | 50% | 50% |
| APT28129 techniques | CM-6SI-4CM-2 | 61% | 39% |
| Lazarus Group128 techniques | SI-4CM-2CM-6 | 60% | 40% |
| APT41115 techniques | SI-4CM-6CM-2 | 64% | 36% |
| Mustang Panda114 techniques | SI-4CM-2CM-6 | 61% | 39% |
| Sandworm Team109 techniques | SI-4CM-6CM-2 | 59% | 41% |
| Magic Hound109 techniques | SI-4CM-6CM-2 | 58% | 42% |
| APT32106 techniques | SI-4CM-6CM-2 | 67% | 33% |
Coverage = the share of an actor's ATT&CK techniques that our cross-walks map the control as mitigating. How actor data is built.
Misconfiguration & host posture
Cloud-posture control data (AWS Trusted Advisor, Azure Secure Score) is on the roadmap, not built yet — those collections exist but currently hold zero records, so we do not show a cloud picture we cannot back. What we do hold is host-configuration hardening: the DISA STIG baselines below, cross-walked to NIST 800-53 via CCIs.
| Hardening baseline | Hardening rules |
|---|---|
| Oracle Linux 9 | 455 |
| RHEL 9 | 452 |
| Oracle Linux 8 | 373 |
| RHEL 8 | 369 |
| Windows Server 2019 | 275 |
| Windows Server 2022 | 275 |
| Windows Server 2016 | 273 |
| Windows 10 | 261 |
| Windows 11 | 258 |
| RHEL 7 | 244 |
| Ubuntu 24 04 | 194 |
| Ubuntu 22 04 | 187 |
3,616 host-hardening rules across 12 DISA STIG baselines — the configuration checks that keep a built system from drifting into an exploitable state. Browse them at /hardening/. Cloud-posture control ingest is tracked as future work.
The weaknesses that are really misconfigurations
11,276 CVEs (distinct) cite a configuration-, permission-, privilege-, or access-control weakness — flaws that are authorization and configuration mistakes rather than code bugs. This is the bridge back to the vulnerability lens: a misconfiguration is an exposure whether or not it carries a CVE.
| Weakness class (CWE) | CVEs | In CISA KEV |
|---|---|---|
| CWE-284Improper Access Control | 6,325 | 33 |
| CWE-269Improper Privilege Management | 3,133 | 20 |
| CWE-732Incorrect Permission Assignment for Critical Resource | 1,717 | 4 |
| CWE-16Configuration | 318 | 0 |
Cohort = CVEs whose NVD weaknesses include CWE-16, CWE-732, CWE-269, or CWE-284. KEV = confirmed exploited-in-the-wild. Browse all weakness classes at /cwes.html.