Determining the exposure level of vulnerabilities

A system comprising:

• data processing hardware;
• and
• memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
• scanning, using a first scanning privilege level, a plurality of network-connected assets for a first vulnerability;
• detecting, based on the scan using the first scanning privilege level, the first vulnerability at at least one network-connected asset of the plurality of network-connected assets;
• in response to detecting the first vulnerability at the at least one network-connected asset of the plurality of network-connected assets, scanning, using a second scanning privilege level, only the at least one network-connected asset of the plurality of network-connected assets for a second vulnerability;
• detecting, based on the scan using the second scanning privilege level, the second vulnerability at a first network-connected asset of the at least one network-connected asset;
• in response to detecting the second vulnerability at the first network-connected asset, determining that the first network-connected asset has a first exposure level;
• determining, based on the scan using the second scanning privilege level, that a second network-connected asset of the at least one network-connected asset does not comprise the second vulnerability;
• in response to determining that the second network-connected asset does not comprise the second vulnerability, determining that the second network-connected asset has a second exposure level that is different from the first exposure level;
• and
• reporting the first exposure level of the first network-connected asset and the second exposure level of the second network-connected asset to a user of the plurality of network-connected assets.