How should security teams prioritise exposure management when most risk is not tied to CVEs?

Security teams should prioritise exposure management around identity, credential, and attack-path risk instead of treating CVE patching as the whole programme. The report says less than 1% of exposures are Remote Code Executable CVEs, while AD weaknesses, cached credentials, and cloud attack paths account for far more practical risk. Focus on where attackers can move, not just where scanners find vulnerabilities.

Why Exposure Management Should Start With Reachable Paths, Not Raw Vulnerability Counts

Exposure management becomes materially more useful when teams rank what an attacker can actually reach and reuse, not what a scanner can merely list. If most meaningful risk sits in identity paths, cached secrets, standing access, and cloud trust relationships, then a CVE-only backlog can leave the organisation looking busy while its easiest routes to compromise remain open. The right question is not how many findings exist, but which findings would let an adversary move, persist, or escalate fastest.

That is why exposure management belongs alongside a broader security posture programme such as the NIST Cybersecurity Framework 2.0, which frames risk as an outcome of governance, identification, protection, detection, response, and recovery rather than patch volume alone. In practice, many security teams discover their true exposure only after an attacker has used an identity path or cloud permission chain that never appeared urgent in the CVE queue.

How Prioritisation Changes When the Main Exposure Is Identity and Attack Path

When most risk is not tied to CVEs, prioritisation should start with the assets and relationships that enable lateral movement. That means mapping where credentials are stored, where privileged access persists, which directories or cloud roles are over-permissive, and which paths connect low-trust entry points to high-value systems. A weakness that is technically unpatched but unreachable may matter less than a cached credential that can be replayed or a service account that can traverse multiple environments.

Operationally, this shifts the work from a pure vulnerability queue to a blended exposure view. Teams should combine vulnerability data with identity inventory, privilege review, authentication telemetry, and attack-path analysis. The practical goal is to identify which exposed conditions create a realistic route from initial foothold to impact. A scanner may report thousands of findings, but only a small subset will alter the adversary’s ability to authenticate, escalate, or exfiltrate.

Rank exposures by blast radius, reachability, and privilege gain, not by raw count.
Separate internet-reachable or identity-reachable issues from isolated technical defects.
Track credential reuse, stale privileged access, and mis-scoped cloud permissions as first-class exposures.
Use validation from detection data to confirm whether a path is actually reachable in your environment.

The decision point is whether a weakness changes attacker movement options; if it does not, it should usually fall behind anything that does. This approach breaks down when inventories are incomplete, because missing identity and relationship data can make the highest-risk paths invisible.

Where Conventional CVE-First Triage Breaks Down

Tighter prioritisation around non-CVE exposure often increases coordination overhead, requiring organisations to balance faster operational clarity against the work of maintaining better asset, identity, and privilege context. That tradeoff is real, and it is where many programmes stall, especially when teams treat exposure management as a scanner replacement instead of a risk-ranking discipline.

There are also edge cases where CVEs still matter disproportionately. Internet-facing systems, exploitable remote code execution issues, and actively weaponised vulnerabilities can outrank identity exposure when they provide immediate unauthenticated entry. The consensus is clear on one point, though: teams should not use CVE severity as a proxy for business exposure. The better filter is whether the issue creates exploitable access, expands privilege, or enables movement toward sensitive assets. If a vulnerability does none of those things, it may be lower priority than a misconfigured trust path, even if the CVSS score looks alarming. The Anthropic report on an AI-orchestrated cyber espionage campaign is a useful reminder that attackers optimise for access and workflow abuse, not for vulnerability counts.

Practically, the hardest cases are hybrid ones where a modest technical flaw becomes serious only because it connects to a high-value identity path or a weak trust boundary. That is where teams need judgement rather than automation alone.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA — Risk Assessment	Exposure management is a risk-ranking problem across assets and paths.
	PR.AA — Identity Management, Authentication, and Access Control	Identity and privilege paths are central to non-CVE exposure.
	DE.CM — Continuous Monitoring	Exposure prioritisation depends on validating which paths are actually reachable.
Recommendation — Assess which exposures create the most realistic business risk and prioritise them first. Tighten authentication and access controls where they expand attacker reach. Monitor exposure signals to confirm which attack paths are live in your environment.
CIS Controls v8	4 — Secure Configuration of Enterprise Assets and Software	Misconfiguration and trust-path weakness often outrank raw CVE volume.
	5 — Account Management	Standing access and stale accounts are common non-CVE exposure drivers.
	6 — Access Control Management	Prioritisation should focus on the permissions that enable movement and escalation.
Recommendation — Harden exposed systems so misconfigurations do not create easy access paths. Remove stale and over-privileged accounts that enlarge the attack surface. Restrict access paths that would let an attacker move from foothold to impact.
MITRE ATT&CK	T1078 — Valid Accounts	Cached credentials and reused accounts are explicit non-CVE attack paths.
	T1068 — Exploitation for Privilege Escalation	Attack-path exposure often becomes material when it enables privilege gain.
Recommendation — Hunt for and revoke account reuse that would let an adversary authenticate legitimately. Block escalation paths that let a low-privilege foothold become administrative access.

Practitioner Guidance

What to prioritise: Start with exposures that reduce attacker friction, especially paths from external access to privileged identity, cloud control plane, or sensitive data. A finding deserves top-tier attention when it increases reachability or privilege, not when it only adds noise to a dashboard.

What to verify: Confirm whether your exposure model includes identity relationships, session persistence, secrets exposure, and privilege chaining. If those layers are absent, the programme will systematically under-rank the most important risks and over-rank isolated technical defects.

Decision rule: Treat CVEs as one input, not the organising principle. If a non-CVE issue can credibly enable authentication, escalation, persistence, or lateral movement, it should move ahead of low-reachability vulnerabilities that cannot change attacker options.

What practitioners underestimate: Exposure management fails most often when teams confuse volume reduction with risk reduction. The strongest signal that the programme is working is not fewer findings overall, but fewer realistic paths from compromise to impact.

Practitioner takeaway: Prioritise the exposures that change how far an attacker can get, because that is where risk becomes operationally real.