One of the most important distinctions in corporate geopolitical risk is also one of the most frequently overlooked:

Exposure is not vulnerability.

Exposure describes the organization's connection to a geopolitical risk.

Vulnerability describes how badly the organization may be affected if that risk materializes.

A company can be highly exposed but resilient.

It may have alternative suppliers, multiple banking relationships, strong liquidity, flexible contracts and diversified markets.

Another company may have lower apparent exposure but extreme vulnerability because one irreplaceable dependency supports the entire operating model.

This is why corporate geopolitical risk should be analyzed through transmission.

The chain is:

EVENT → TRANSMISSION CHANNEL → DEPENDENCY → EXPOSURE → VULNERABILITY → IMPACT

Transmission channels can be political, regulatory, financial, commercial, technological, operational, security-related or reputational.

Consider sanctions.

The geopolitical event itself does not tell management the corporate impact.

The sanction may reach the company through its bank.

A customer.

A supplier.

A beneficial owner.

A technology licence.

An insurer.

Or a logistics provider.

Each creates a different risk pathway.

Vulnerability then depends on variables such as concentration, substitutability, switching cost, recovery difficulty, financial buffers and preparedness.

This is what transforms geopolitical intelligence into corporate decision-making.

Executives can now ask:

Which dependencies are critical?

Which have alternatives?

Which would fail first?

Which impacts are reversible?

Which would threaten project viability?

And which threshold should cause action?

This leads naturally to a decision ladder:

Monitor → Prepare → Hedge → Adapt → Suspend → Exit.

Thresholds must be project-specific.

There is no universal percentage that tells every company when to exit a country.

A 20% revenue exposure may be manageable to a diversified multinational and existential to a smaller organization.

Corporate architecture matters.

Risk appetite matters.

Liquidity matters.

Strategic objectives matter.

And because these thresholds can be defined in advance, companies can make better decisions under pressure.

But before relying on a strategic response, management should test whether it actually works.

That is the role of stress testing and war gaming.