# Exposure Observatory by Datadog

> Exposure Observatory: a simple guide to the exposure loop (assess, prioritize, fix, verify), how it applies to CVEs, misconfigurations and identity, live sightings, and a short maturity self-assessment.

Exposure sightings from Datadog data across 80,000+ real-world environments, a simple loop for fixing what matters, and a three-minute maturity check. undefined

The page itself renders with JavaScript; these files carry the same content as text.

## Content

- [llms.txt](/llms.txt): Start here: what this site is and where everything lives, in the llms.txt format.
- [llms-full.txt](/llms-full.txt): The whole site as Markdown: loop, exposures, phases, rules, questions and glossary.
- [agent/assessment.json](/agent/assessment.json): Gates, questions, evidence, answer values and the scoring rule, ready for an agent to run the assessment.
- [agent/ddsql.json](/agent/ddsql.json): Every DDSQL check, keyed by exposure.
- [agent/glossary.json](/agent/glossary.json): Every term and definition.

## Sample prompts

- Find my real exposures (Bits AI): List critical vulnerabilities in our production services that are publicly accessible and have a known exploit or an EPSS score above 0.1. Group them by service and tell me which sit on an attack path to sensitive data.
- Check my identity loop (Bits AI): Which IAM users and roles have access keys or permissions unused for 90 days? Rank them by privilege and flag any role that can be assumed from another account.
- Measure mitigation speed (Bits AI): What's our average time from first detection to resolution for critical security findings over the last 26 weeks, split by team? Which findings were closed without a follow-up scan?
- Spot drift (Bits AI): Show cloud misconfigurations from the last 30 days on resources that are also managed in Terraform, and tell me which fixes were later reverted.
- Run the assessment with me (Any agent): Read https://www.exposureobservatory.com/agent/assessment.json. Ask me the questions for the dependency CVE class one at a time, ask for evidence whenever I say yes, then score me using the rules in the file and tell me my phase and next moves.
- Plan the next phase (Any agent): Using the Exposure Observatory model at https://www.exposureobservatory.com/llms-full.txt: I'm at Phase 2 (Suggest) for identity risk. Draft a 90-day plan to pass the gate to Bounded apply, with owners, the evidence to collect, and the first control class to automate behind a feature flag.
- Check my environment (Any agent): From https://www.exposureobservatory.com/agent/ddsql.json, pick the DDSQL checks for CVEs and identity. Explain what each one finds, then help me run them in the Datadog DDSQL Editor and turn the results into a prioritized fix list.

## Optional

- [DDSQL Editor docs](https://docs.datadoghq.com/ddsql_editor/): where to run the DDSQL checks