How exposed are you, really?
One number for what an adversary can find about you and what they are already doing with it. The audit sets it. The work moves it. The annual refresh states the difference.
Your number comes from an Exposure Discovery audit, run by our analysts. It starts with a short, confidential call.
Most firms in this market measure their own activity: records requested, alerts sent, sources scanned. Those numbers go up whether or not you are safer. The Threat Surface Index measures the thing you actually care about, and it says plainly which part of it we can change and which part we cannot.
TSI · Scored 0 to 100 · Four variables · Methodology stated with every score
Four variables.
Three you can move.
Exposure is not one thing. It is what can be found about you, how you operate, who has access to you, and how much attention is pointed your way. Each behaves differently, and only three of them respond to work.
Exposure
What an adversary can find: broker records, breach and stealer corpora, public filings, social and open sources, imagery. The widest lever in the model, because it is the most reducible.
Posture
How you and your household operate: device and account hygiene, communications, travel, financial activity. It either amplifies the rest of the score or cuts it, though with diminishing returns: the first improvements pay well and the last ones barely pay at all, because past a well coached household the remaining exposure sits in other people's records.
Circle
Who holds access to you: family, assistants, household staff, close associates. Risk grows with the size of the circle and falls as its members are covered, though never to zero.
Hostility
The attention, adversaries, and intent directed at you. Nothing any firm does makes a person less interesting to someone who has already decided to fixate.
What the number actually means.
A score without a band is a number without a verdict. Four bands, and each one implies a different answer to the only question that matters: what should be done about it.
Low
Little targeted attention and a small findable footprint. The residual exposure is opportunistic: credential stuffing, scattershot fraud, the things that happen to everyone.
- Baseline hygiene holds
- Annual refresh is enough
Moderate
Enough exists to assemble a usable profile, without evidence that anyone has. This is where most clients land after a year of reduction, and where the work becomes maintenance.
- Reduction plus coverage
- Watch what cannot be removed
High
A profile is available to anyone who wants one, and attention may already be pointed at you. Most clients score here at intake, before anything has been done.
- Reduction is urgent
- Continuous coverage warranted
- Household in scope
Extreme
Substantial exposure and substantial hostility at the same time. The question stops being what can be removed and becomes how much warning you have.
- Lead time is the objective
- Attribution likely in scope
- Coordination with counsel
An ambient exposure floor is always applied, so opportunistic risk never scores near zero regardless of how little targeted hostility a client draws.
A first score is a diagnosis. A second one is proof.
The single number is useful on day one because it tells a client where they stand and which variable is carrying the risk. It becomes considerably more useful twelve months later.
The annual refresh re-runs the audit and re-scores every variable. The difference between the two is the clearest available statement of what the work actually produced, and it is stated variable by variable rather than as one figure, because a score that fell only because hostility cooled is not the same as a score that fell because the exposure was removed.
This is why the firm does not report requests filed or alerts sent. Those measure our activity. The delta measures your exposure.
Baseline
Exposure Discovery scores all four variables and names which records can move, which can only be suppressed, and which will not move at all.
Work
Reduction runs against the map through the year. Training moves Posture. Household coverage moves Circle.
Refresh
The audit runs again. Every variable is re-scored on the same methodology version, or the change in version is stated.
Delta
Reported variable by variable, with the part attributable to work separated from the part attributable to circumstance.
What the Index does not do.
A metric that claims too much is worse than no metric, so here is the boundary, stated the way we state findings.
It does not predict an attack
It measures exposure and the attention pointed at it. No instrument can tell you that something will happen, and any firm offering one is selling a feeling.
It does not reach zero
An ambient floor is always applied. Even a client with excellent posture and a fully covered circle retains opportunistic risk, and the model says so rather than rounding it away.
It is not a compliance score
Nothing here certifies anything to anyone. It exists to direct work and to measure whether the work moved what it was aimed at.
It is scored, not sensed
The four variables are composed from measured inputs, weighted, and normalized. The composition is written down, and every score is issued with the methodology version it was computed under.
It is not the whole assessment
The number directs attention. The audit report is what a client actually acts on, and the Command Brief is where the judgment lives.
Every variable, and what each one does.
The composition is written down, so here it is running. Load a profile, or move any input and watch which levers actually move the number. The one thing this cannot give you is your own score. The footprint variables are measured rather than estimated, and measuring them is what the audit does.
Not reducible · Watched, never lowered
Named adversaries, coordinated activity, litigation and press pressure, prior incidents.
Reducible, with diminishing returns · Moved by Tactical Privacy Training
Device and account hygiene, communications, travel pattern, financial activity. Gains arrive fast and then flatten. Past a well coached household, what is left is held in other people's records rather than in anyone's habits, and no amount of discipline reaches it.
Reducible · Moved by Circle of Trust
Family, assistants, household staff, close associates who can be reached to reach you.
Members brought under reduction and monitoring. A covered circle never reaches zero risk.
Reducible · The widest lever · Moved by Exposure Reduction
Methodology v0.4 · Illustrative scoring, pending calibration against completed audits · Nothing entered here is transmitted, stored, or logged. The model runs in your browser.
The audit is how you get a number.
Exposure Discovery opens Obscurity, and it can be run on its own.
It maps where your data lives across the broker ecosystem, breach and infostealer corpora, public records, open sources, and identity infrastructure, assesses what each holding still enables, and returns your score across all four variables. It arrives as a written report and a private readout.
A confidential call comes first, and it is short by design.
- Phone
- 855.76.ERASE
- info@obscureiq.com
- Counsel
- Introductions on request
- Handling
- Encrypted intake. Off the record by default.