The Applications tab lists every business application, ranked from most to least exposed. It is the main working list for deciding where to spend remediation effort.
The list comes from your line-of-business application list. A scanner finding appears under an application when the server it was found on matches one of that application's servers by hostname or IP address. If an application looks empty or a finding seems to be missing, check that the server names match. See Before You Begin: What Frontier AI Defense Needs.
Open the list
Select Exposure in the top navigation bar, then select the Applications tab.
The Applications tab ranks every application by Exposure score, highest first.
Reading each row
| Column | What it means |
|---|---|
| Application | The application's name, with a tag showing its worst exploitation grade (for example CISA KEV or Actively exploited). Select the name to open its details. |
| Exposure | The 0–100 Exposure score. Higher means more exposed. See How the ranking works. |
| Criticality | How important the business says this application is (Critical, High, Medium, Low). It is shown for context only and does not change the score. |
| Fixes | How many findings the single best fix would clear, and how many fixes would clear everything that has a fix. |
| Device health | How many of the application's devices are behind on patching (90+ days), have never been scanned, or are past end-of-life. |
| Business owner | The person accountable for the application. Shows no owner on file if none is recorded. |
| Remediation owners | The IT teams responsible for patching the application's devices. |
| Dispatch | A Compile button to send work, and a link showing how many dispatches have already gone out. See Sending Fixes to Remediation Teams. |
Filtering the list
Use the filters above the table to narrow the list. You can pick more than one value in each filter; select Clear filters to start over.
- Exploitation — Actively exploited, Exploit PoC, or No known exploit.
- Gaps and disagreement — problems worth chasing, such as:
- No business owner or Cannot be dispatched — nobody to send the work to.
- Actively exploited, no vendor fix — being attacked, but there is no patch yet.
- One fix clears 40%+ — quick wins where one change removes a large share of the problem.
- Devices behind on patching, Devices never scanned, Devices past end-of-life.
- Change closed, still detected — a ticket was closed, but scans still find the problem.
- Remediated, change still open — scans show the problem is gone, but the ticket is still open.
- Team — show only the applications a particular remediation team is involved in. This is a view of the shared list, not a separate copy; compiling work from here pre-selects that team.
- Business criticality — Critical, High, Medium, or Low.
The Overview cards use these same filters. For example, selecting the Nobody to dispatch to card opens this list filtered to Cannot be dispatched.
How the ranking works
The list is sorted by Exposure score, highest first. When two applications have nearly the same score, the one whose vulnerabilities are more likely to be exploited soon (higher EPSS) comes first. You can also sort by Application, Criticality, Fixes, or Device health by selecting the column heading.
In short, the Exposure score goes up when an application has more serious findings, and especially when any of them are being exploited. It goes down only when findings are actually fixed or the device is retired. For the full explanation, see How the Exposure score works.
Exporting the list
Select Export at the top of the page to download the list as a CSV file you can open in Excel. The export includes only the applications that match your current filters, and adds detail columns such as open Critical and High counts, device counts, and dispatches sent.