Posture and Exposure

Detections answer what happened. Posture answers what is standing there waiting, and it is collected by the same sensor on the same schedule.

What is collected

Each host reports the packages installed on it, the published vulnerabilities open against those packages, and a light bill of materials for the software it carries. It is an inventory, not a scan: the sensor reads what the machine's own package state already says rather than probing it.

Read one host from the host:

whisper posture status

Read the estate from anywhere your key reaches:

curl -s -X POST https://graph.whisper.online/api/query \
  -H 'content-type: application/json' \
  -H 'X-API-Key: <your key>' \
  --data-binary @- <<'JSON'
{"query": "CALL whisper.agents({op: 'list', kind: 'posture'})"}
JSON

The console's exposure view is the same reading across every host that carries a sensor.

Ranked by what is actually being used

A list of open vulnerabilities sorted by severity puts the loudest first, not the most dangerous. Exposure orders candidates by evidence that something is being exploited in the wild, then by how severe it is where it lands, so a moderate flaw with live exploitation outranks a critical one nobody has touched. That evidence comes from the same graph that scores a destination, which means the ordering moves when the world does, not when the inventory does.

Where it meets identity

Posture is attached to the host's address, so it joins the rest of what you know about that machine: the tier it reaches the internet on, the sensor depth it reports at, its detections, and the identity anyone can verify from outside. A host that is exposed and routed is a different problem from one that is exposed and resolver-only, and your fleet is where that pairing is visible.

Posture on a machine with no sensor is the one part that does not arrive, because nothing on it reads the package state. Endpoints with no sensor covers what does.

What to do with it

Nothing here acts on its own. A package the graph says is being exploited is an argument for patching it, and until that happens, an argument for narrowing what the host may reach. That second part is policy rather than posture: see resolver policy and contain an endpoint.