Skip to content
ENExplore Calculators

Exposure Window Calculator

Measure the days between disclosure and deployment, the asset-days at risk and the cumulative chance of exploitation in that window.

About Exposure Window Calculator

The window has three segments and you own two of them. Detection lag is an asset-inventory and intelligence problem; deployment lag is a change-management problem; only patch availability belongs to the vendor. Because cumulative probability compounds geometrically, halving the window removes rather more than half the risk at low daily rates and much more at high ones. Almost every breach traced to a known CVE happened inside a window that someone had already measured and tolerated — the number only helps if it drives the deployment lag down.

Formulas

Exposure Window

Exposure window = detection lag + patch-availability lag + deployment lag. Cumulative exploitation probability = 1 − (1 − dailyProbability)^window, and asset-days at risk = window × affected assets.

detection lag
Disclosure until you know you are affected
deployment lag
Patch released until every asset carries it
asset-days
Aggregate exposure across the estate
dailyProbability
Chance of an attempt against one asset on one day

Aggregate exposure

Asset-days at risk = window × assets — the aggregate measure that makes a 3-day window across 5,000 hosts comparable to a 60-day window across 250.

Worked example

With the default values below, Exposure Window Calculator returns Total Exposure Window of 32. Change any input above and every figure here is recalculated in your browser.

Inputs used

Disclosure to your detectionaccepts 0–365 days
4 days
Detection to vendor patch availableaccepts 0–365 days
7 days
Patch available to fully deployedaccepts 0–365 days
21 days
Affected assetsaccepts 1–1,000,000 assets
320 assets
Daily probability of exploitation attemptaccepts 0–100 %
0.4 %

Results

Total Exposure Window
32 days
Asset-Days at Risk
10,240 asset-days
Chance of Exploitation in the Window
12.04%
Days You Control
25 days
Risk if the Window Halves
6.21%
Risk Removed by Halving
48.4%
Biggest Lever
Deployment speed — 21 days pass with a patch already in hand

Step by step

  1. 1Values used
  2. 2Exposure Window
  3. 3Aggregate exposure
  4. 4Total Exposure Window= 32 days
  5. 5Asset-Days at Risk= 10,240 asset-days
  6. 6Chance of Exploitation in the Window= 12.04
  7. 7Days You Control= 25 days
  8. 8Risk if the Window Halves= 6.21
  9. 9Risk Removed by Halving= 48.4

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Exposure Window calculated?

Exposure window = detection lag + patch-availability lag + deployment lag. Cumulative exploitation probability = 1 − (1 − dailyProbability)^window, and asset-days at risk = window × affected assets. The window has three segments and you own two of them. Detection lag is an asset-inventory and intelligence problem; deployment lag is a change-management problem; only patch availability belongs to the vendor. Because cumulative probability compounds geometrically, halving the window removes rather more than half the risk at low daily rates and much more at high ones.

Why does Exposure Window matter?

Almost every breach traced to a known CVE happened inside a window that someone had already measured and tolerated — the number only helps if it drives the deployment lag down.

What values do I need to enter?

This calculator takes 5 inputs: Disclosure to your detection, Detection to vendor patch available, Patch available to fully deployed, Affected assets, Daily probability of exploitation attempt. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

What if the vendor has no patch during the window?

Then the middle segment is fixed and the only lever is mitigation: virtual patching, disabling the feature or isolating the asset. Log the mitigation date as the effective end of the exposure window for risk purposes, and the real patch date for compliance.

Where do I get a daily exploitation probability?

Derive it from EPSS: a 30-day EPSS score of p implies a daily rate of 1 − (1 − p)^(1/30). For a 6% EPSS score that is about 0.2% per day. Use the exploit probability calculator to do the conversion.

Related Calculators

Exposure Window Calculator – Calculate Total Exposure Window