A person's exposure is usually thought of as the sum of what is known about them, the facts that have, in one way or another, been disclosed. That is only part of it. The rest is what can be inferred.

Inference is the drawing of a conclusion that was never stated, from things that were. It does not require a fact to be disclosed. It requires only enough surrounding facts, and an understanding of how such facts usually relate, for the missing one to be deduced with reasonable confidence.

This is more powerful than it first appears. A person may take care never to disclose a particular thing, and may believe, on that basis, that it is private. But if the things they have disclosed point reliably towards it, the care was spent in the wrong place. The undisclosed fact is exposed not directly but by deduction, and deduction leaves no trace of the person having revealed anything.

What can be inferred is wide. From a pattern of locations, a routine. From a set of associations, a role or an interest. From the visible parts of an arrangement, the shape of the parts that are not visible. A competent party works not only with what a person has shown but with what that necessarily implies.

For someone whose direct disclosures are carefully managed, this is the part most often missed. They assess their exposure by asking what they have revealed, and conclude it is little. The better question is what their revealed information, taken together, allows a thoughtful party to conclude, because that is the true extent of what is exposed.

Inference cannot be entirely prevented. It is simply what an intelligent observer does. But it can be understood. An honest account of exposure includes not only the facts on the record but the conclusions those facts make available to anyone willing to think them through.