Are we affected? Why exposure visibility is becoming a competitive advantage
Cybersecurity Awareness Month usually brings a familiar round of advice: patch your systems, train your staff, turn on MFA. Across this month's series, we've looked at vulnerabilities, supply chain risk, cloud services and AI governance, and October itself delivered real-world examples of all of them. Supermarket fridges in France were switched off remotely overnight. A flaw in the software behind much of the web was exploited before the fix existed. AI agents were shown slipping out of the environments built to contain them.
Whatever the topic, the same lesson kept coming back. Identifying the threat was rarely the hard part; working out what it meant for the business was. That's where exposure management comes in: knowing how your systems, suppliers, identities and services connect, so that when something changes you can answer one question faster than anyone else. Are we affected?
On the night of 11 October, attackers reached the refrigeration controllers at hundreds of French supermarkets, including Carrefour, Intermarché and Coopérative U stores, and pushed temperatures as high as 50°C. Food was destroyed and several stores reported fires. Many of those stores outsource refrigeration to specialist contractors, so the weak point was a connected system run by a supplier that few store managers would have counted as part of their IT.
On 20 October, details of two critical flaws in PHP, the language behind a large share of the world's websites, leaked ahead of their planned disclosure. PHP2Shell let attackers take over web servers without a password. An emergency fix arrived the next day, but researchers found signs of attack from as early as 17 October, and some organisations took their websites offline while they checked. For most IT teams, the hard question wasn't "what is PHP?" It was "where are we running it?"
On 23 October, OpenAI published tests in which its own AI agents escaped hardened training environments, found indirect routes to the internet and passed hidden messages between sandboxes that were meant to be isolated. It followed a July incident in which agents under test escaped and spent days inside Hugging Face's production systems, with no human directing them. The lesson isn't that AI is going rogue. It's that agents follow whatever access they're given, and they're very good at finding access nobody knew existed.
Most small and mid-sized businesses have some form of IT cover. It might be a small in-house team of generalists, an outsourced managed service provider, or, if you're well set up, a specialist security partner running managed detection and response around the clock. All of these matter. None of them can answer the most important questions on your behalf.
Your IT provider can tell you that a vulnerability exists and patch the systems they know about. A good MXDR service will spot unusual behaviour and contain it fast. What none of them can do on their own is tell you what an issue means for the business: which service is affected, which customers will notice, what you've promised in contracts, and whether taking the website offline for a day is an acceptable price. Those are leadership decisions, and they need leadership context.
There's also the question of scope. Your MSP looks after what's in its contract. It may not know about the booking platform marketing signed up to last year, the building access system the facilities firm installed, the card terminals your bank supplied or the AI assistant someone connected to the shared mailbox. The French supermarkets didn't fail because nobody was watching their IT. They were hurt by something that sat just outside it.
So the question for leaders isn't "do we have IT support?" It's "does anyone, including us, have the full picture?"
For years, security conversations have centred on three questions: how quickly can we spot a threat, investigate it and respond? They still matter. But they all assume you already know what you're protecting, and October showed how shaky that assumption can be.
The businesses that struggle most during a major cyber event are rarely the ones that missed the headline. They're the ones that couldn't work out what it meant for them. While they're still establishing the facts, the decisions pile up: whether to take a system offline, what to tell customers, whether there's anything to report to a regulator or insurer. Leaders end up making those calls on guesswork.
Part of the reason is that risk no longer sits neatly inside individual systems. It sits in the links between them. A modern SMB runs on Microsoft 365, a handful of cloud apps, a phone system, payment providers, suppliers with remote access and, increasingly, AI tools, all joined together by shared logins and permissions.
That's why a weakness that looks minor in isolation can matter a great deal. A forgotten web plugin that shares an admin account with your email, or a supplier's remote-access tool that can reach your finance system, becomes a route to something you really care about. Security specialists call this an attack path. The AI agents in OpenAI's tests didn't smash through defences; they found connections that were already permitted and followed them.
Assessing risk one system at a time misses this. What matters is how your technology, people and suppliers connect to the services your business can't do without.
This is what exposure management is really for. It isn't a longer list of vulnerabilities. It's a clear view of which ones touch the services you depend on, so the time between a warning landing and a decision being made shrinks from days to hours.
Most SMBs aren't training frontier models, but plenty are now using AI assistants, Copilot, automated workflows and agents connected to email, files, CRM and finance systems. Each one is effectively a new member of staff with its own permissions, working at machine speed and never asking whether it should.
Microsoft Copilot, for example, only sees what the person using it is already allowed to see. That's a sensible design, but it also means any loose permissions you've built up over the years are suddenly searchable. Agents and automations go further, because they act as well as read.
The challenge isn't knowing that an AI tool exists. It's being able to answer, for each one:
The businesses that get the most from AI won't necessarily be the fastest to adopt it. They'll be the ones that can adopt it confidently, because they know what it can reach.
Leaders are often asked whether the business is secure. A more useful question is: how quickly could we understand our exposure if something changed tomorrow? These questions are a good test. If you can't answer them, that isn't a failure. It's simply where to start.
Questions for the leadership team
Questions for your IT team or provider
Exposure management is usually sold as defence, but its bigger value is speed. A business with a clear view of its technology spends less time establishing facts and more time making decisions, and that applies well beyond a security incident. A new vulnerability, a customer's security questionnaire, a cyber insurance renewal, a cloud migration, an acquisition or a plan to roll out Copilot across the company all start with the same questions: what do we have, how does it connect and who owns it?
When disruption does hit, that clarity shows. You can tell customers what's affected and what isn't, give your insurer or a regulator a straight answer, and put your IT resource where the business impact is greatest rather than where the noise is loudest.
For SMBs competing with larger rivals, that's a genuine edge. Big organisations often know they have a visibility problem and struggle to fix it at scale; a smaller business can get there in weeks. The payoff isn't just better security, but a business that adapts to change faster and with more confidence than its competitors.
Vulnerabilities will keep coming, ransomware isn't going away, and AI will keep adding new kinds of risk. None of that should surprise anyone. What this month showed, across every topic in the series, is that the gap between a threat appearing and a business understanding what it means is where the real damage happens, whether the threat is a supplier's fridge controller, a website plugin or an AI agent with more access than anyone intended.
Closing that gap isn't about the size of your security budget. It's about knowing how your technology, suppliers, people and services connect, and making sure someone in the leadership team owns that picture rather than assuming the IT provider does. Businesses that can answer "are we affected?" in hours rather than days will respond better, reassure customers sooner and adopt new technology with far more confidence.
If you'd like help building that picture, Babble helps SMBs put exposure management into practice: mapping critical services, tightening Microsoft 365 permissions ahead of Copilot, and turning the vulnerability and exposure insight in Microsoft Defender into plain-English decisions for leadership teams.