Why do the words matter?
ASM reports use "exposed", "vulnerable", "at risk" and "exploitable" as if they meant the same thing. They do not, and the difference decides how much work a security team takes on. Each word is a stronger claim than the one before, and each needs stronger evidence.
Reachable
A reachable asset answers when someone on the internet connects to it: a web server on port 443, a database on a nonstandard port, a remote access gateway. Reachability is a fact you can observe with a scan. Censys, for example, describes reachability confirmation as part of its exposure management, based on first-party scanning across all 65K ports.
Reachable is not the same as dangerous. Plenty of services are meant to be reachable. The question is whether they should be, and whether anything behind them is weak.
Vulnerable
A vulnerable asset runs software with a known weakness, usually a published CVE. Most tools infer this from a banner, a version string or a fingerprint. The inference can be wrong in both directions: the version might be patched by a backport, or the fingerprint might miss a vulnerable component.
The usual way to rank vulnerable findings is a severity score. CVSS, maintained by FIRST, gives a numerical score for the severity of a vulnerability, with qualitative ratings of low, medium, high and critical; version 4.0 was published in November 2023. Severity describes how bad a weakness is in general. It does not describe your deployment.
Exploitable
An exploitable asset can actually be attacked through the weakness as it is deployed: the vulnerable code path is reachable, no control in front of it blocks the attack, and the attack achieves something. Proving this needs a test, not an inference. Lesson 4 covers how tools do that safely.
Where do EPSS and KEV fit?
Two public sources sit between vulnerable and exploitable.
- EPSS, the Exploit Prediction Scoring System from FIRST, estimates the probability that a published CVE will be exploited in the wild in the next 30 days. Scores run from 0 to 1, are published daily and are free to download.
- The CISA Known Exploited Vulnerabilities catalog lists CVEs with reliable evidence of active exploitation and a clear remediation action. CISA recommends that every organization include a requirement to immediately address KEV catalog vulnerabilities in its vulnerability management plan.
Both describe the world, not your estate. A CVE in KEV is being exploited somewhere; whether it is exploitable on your asset still needs a check.
What does this mean for an ASM report?
Read each finding and ask which claim it makes. A reachable finding asks: should this be on the internet at all? A vulnerable finding asks: is the version really affected, and is the CVE likely to be used (EPSS) or already used (KEV)? An exploitable finding asks: who owns it, can we contain it today, and when will it be fixed?
The tools on this site differ most on the last step. Our proves exploitability criterion scores how specifically each vendor documents moving a finding from vulnerable to exploitable.