The platform has built in security policies to help identify if you have unencrypted or public ports accessing your infrastructure.  The two main ways to review this report are the following: 

1. The resulting instances in the Unencrypted Public Port Exposure part of the report are coming from `Reports > Security > Open Ports`. The platform checks many ports for all the instances and see if any of them are unencrypted and have public permissions. 

2. A "Possible" security exposure means there could be a data breach or a possibility of infecting the network if those ports were public or unencrypted. Exact security risk depends on what that port is capable of doing. That's why we keep the security risk message generic: 'Unencrypted Public Port Exposure'. For example, FTP and SFTP related security risks, if left unencrypted and public, can be found here -> https://www.helpsystems.com/blog/10-essential-tips-securing-ftp-and-sftp-servers