Exposure Window Calculator

Measure the days between disclosure and deployment, the asset-days at risk and the cumulative chance of exploitation in that window.

Inputs

Disclosure to your detectiondays

Detection to vendor patch availabledays

Patch available to fully deployeddays

Affected assetsassets

Daily probability of exploitation attempt%

Total Exposure Window

32days

Asset-Days at Risk

10,240asset-days

Chance of Exploitation in the Window

12.04%

Days You Control

25days

Risk if the Window Halves

6.21%

Risk Removed by Halving

48.4%

Biggest Lever

Deployment speed — 21 days pass with a patch already in hand

Step by step

Values used
Disclosure to your detection = 4 days; Detection to vendor patch available = 7 days; Patch available to fully deployed = 21 days; Affected assets = 320 assets; Daily probability of exploitation attempt = 0.4000 %
Exposure Window
Exposure window = detection lag + patch-availability lag + deployment lag. Cumulative exploitation probability = 1 − (1 − dailyProbability)^window, and asset-days at risk = window × affected assets.
Aggregate exposure
Asset-days at risk = window × assets — the aggregate measure that makes a 3-day window across 5,000 hosts comparable to a 60-day window across 250.
Total Exposure Window
= 32 days
Asset-Days at Risk
= 10,240 asset-days
Chance of Exploitation in the Window
= 12.04
Days You Control
= 25 days
Risk if the Window Halves
= 6.21
Risk Removed by Halving
= 48.4

How it works

The window has three segments and you own two of them. Detection lag is an asset-inventory and intelligence problem; deployment lag is a change-management problem; only patch availability belongs to the vendor. Because cumulative probability compounds geometrically, halving the window removes rather more than half the risk at low daily rates and much more at high ones. Almost every breach traced to a known CVE happened inside a window that someone had already measured and tolerated — the number only helps if it drives the deployment lag down.

Formulas

Exposure Window

detection lag: Disclosure until you know you are affected
deployment lag: Patch released until every asset carries it
asset-days: Aggregate exposure across the estate
dailyProbability: Chance of an attempt against one asset on one day

Aggregate exposure

Asset-days at risk = window × assets — the aggregate measure that makes a 3-day window across 5,000 hosts comparable to a 60-day window across 250.

Frequently Asked Questions

How is Exposure Window calculated?

Exposure window = detection lag + patch-availability lag + deployment lag. Cumulative exploitation probability = 1 − (1 − dailyProbability)^window, and asset-days at risk = window × affected assets. The window has three segments and you own two of them. Detection lag is an asset-inventory and intelligence problem; deployment lag is a change-management problem; only patch availability belongs to the vendor. Because cumulative probability compounds geometrically, halving the window removes rather more than half the risk at low daily rates and much more at high ones.

Why does Exposure Window matter?

Almost every breach traced to a known CVE happened inside a window that someone had already measured and tolerated — the number only helps if it drives the deployment lag down.

What values do I need to enter?

This calculator takes 5 inputs: Disclosure to your detection, Detection to vendor patch available, Patch available to fully deployed, Affected assets, Daily probability of exploitation attempt. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

What if the vendor has no patch during the window?

Then the middle segment is fixed and the only lever is mitigation: virtual patching, disabling the feature or isolating the asset. Log the mitigation date as the effective end of the exposure window for risk purposes, and the real patch date for compliance.

Where do I get a daily exploitation probability?

Derive it from EPSS: a 30-day EPSS score of p implies a daily rate of 1 − (1 − p)^(1/30). For a 6% EPSS score that is about 0.2% per day. Use the exploit probability calculator to do the conversion.

You might also need

Exploit Probability Calculator Mean Time to Patch Calculator Patch Priority Calculator