The term “exposure” can mean many things. In the context of this report, they define “exposure” as offering services that either expose potentially sensitive data over cleartext channels or are widely recognized to be unwise to make available on the internet, such as database systems. They looked for the presence of 30 of the most prevalent TCP services across the internet, tallied up the results and performed cross-country comparisons to produce a National Exposure Index, a ranked aggregation of the results of Rapid7’s internet-wide scans of 16 usually cleartext or highly targeted common services, based on the in-country prevalence of those services.