TL;DR: With over 48,000 CVEs published in 2025 and attackers exploiting them in about 20 hours, Seemplicity argues that vulnerability management now needs AI-driven prioritisation, continuous discovery, and attack-path analysis because scan volume alone no longer reflects real risk. The deciding control is not patch throughput but the ability to reduce exposure paths before adversaries traverse them.
At a glance
What this is: This blog argues that traditional vulnerability management is too slow and too fragmented for modern environments, because exposure can be created and exploited faster than point-in-time scanning and patch queues can respond.
Why it matters: It matters because security teams need to judge which exposures create reachable attack paths, not just which CVEs exist, and that directly affects cloud, endpoint, app, and identity-adjacent control decisions.
By the numbers:
- In 2025, over 48,000 CVEs were published, which is roughly 130 new vulnerabilities every single day.
- The average time from CVE disclosure to active exploitation is now just 20 hours.
Context
Vulnerability management breaks down when the organisation measures exposure as a list of findings instead of a set of reachable attack paths. In hybrid environments, point-in-time scans, disconnected tooling, and ephemeral assets create a governance gap between what is known and what is actually exploitable.
The article also shows why this is now a broader cyber governance issue rather than a narrow patching problem. AI-assisted code creation, rapid deployment, and attacker automation compress exposure windows, while security teams still depend on workflows that assume slower change and more stable assets.
Key questions
Q: What breaks when vulnerability management is limited to scan results?
A: Teams end up triaging large numbers of findings without knowing which ones can be chained into a working attack. That creates remediation noise, slows response to genuine exposure, and leaves identity, session, and workflow weaknesses under-prioritised until they are already being abused.
Q: Why does attack-path prioritisation reduce risk better than CVSS ranking?
A: CVSS describes technical severity, but it does not tell you whether a weakness sits on a reachable route to a critical asset. Attack-path prioritisation adds reachability, privilege, and business context, so remediation effort follows likely attacker movement instead of abstract score ordering. That makes scarce security work target the routes that matter most.
Q: What are the signs that vulnerability management is not working well enough in an enterprise?
A: Common warning signs include long remediation cycles, weak visibility into where vulnerabilities exist, and inconsistent prioritisation of high-risk findings. If teams keep repeating the same issues, rely on ad hoc reports, or lack a clear treatment path, the programme is probably underperforming. Another signal is when vulnerabilities are discovered only after attackers or audits surface them.
Q: How should teams govern AI-generated vulnerabilities before they reach production?
A: Start by treating AI-assisted development as a governed change path rather than a convenience layer. Require inventory, ownership, review thresholds, and exception handling for every AI-enabled workflow so vulnerable output is caught before release rather than triaged after exposure has already accumulated.
Technical breakdown
Why point-in-time scans miss exposure paths
Traditional vulnerability management treats assessment as a snapshot. That works only when assets are stable long enough for the scan result to remain meaningful, but modern environments include containers, serverless functions, temporary test systems, and rapidly changing cloud resources. Once those assets appear and disappear between scans, the inventory itself becomes incomplete. The real failure is not just stale data. It is that scan output tells you where weaknesses exist, while attackers care about whether a weakness sits on a reachable route to something valuable.
Practical implication: move from scan-only coverage toward continuous asset discovery and path-aware exposure management.
How attack-path analysis changes prioritisation
Attack-path analysis models how an adversary would move from an exposed weakness to a crown-jewel asset. Instead of ranking thousands of CVEs by severity alone, it connects exploitability, exposure, privilege, network adjacency, and business criticality. That matters because a high-score vulnerability on an isolated system may be less urgent than a lower-score issue that sits on a direct route to sensitive data or privileged infrastructure. AI is useful here when it helps correlate context at scale, not when it merely accelerates the old queue.
Practical implication: prioritise remediation by path-to-impact, not by CVSS rank alone.
Why exploitability intelligence matters more than raw volume
A vulnerability becomes operationally urgent when it is known to be weaponized, has a proof of concept, or sits on an asset that can be reached immediately. Raw vulnerability counts do not distinguish between theoretical exposure and active risk. In a fast exploitation cycle, the timing of disclosure, public exploit availability, and patch readiness all change the decision. That is why modern exposure management needs exploitability context, not just more findings. The control question shifts from how many issues exist to which issues can actually be used now.
Practical implication: enrich vulnerability workflows with KEV, proof-of-concept, and patch-readiness signals before assigning remediation priority.
Threat narrative
Attacker objective: The attacker’s objective is to reach high-value assets quickly enough that defensive scanning and patch queues cannot interrupt the path.
- Entry begins when a newly disclosed vulnerability appears on an exposed asset before the security team has fully discovered or assessed it.
- Escalation follows when the attacker uses the short exploitation window, plus adjacent exposure or privilege conditions, to reach a more valuable system.
- Impact is the conversion of a single vulnerable path into real compromise, data exposure, or broader environmental access before remediation closes the route.
Breaches seen in the wild
- Gravity SMTP CVE-2026-4020 API Keys Exposure: CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Attack-path control is the real governance shift: vulnerability management is no longer a count-and-close exercise, because the issue is not how many CVEs exist but which ones sit on a traversable route to critical assets. In modern environments, exposure is relational, not isolated, so the security model has to understand adjacency, privilege, and reachability. That is the governance gap the article identifies, and it is the gap defenders must close.
Fragmented visibility creates exposure debt: when cloud, endpoint, SaaS, container, and code-repository data stay siloed, the organisation cannot see where vulnerabilities combine into a usable path. This is not just a tooling problem, it is an operating model problem, because the risk is formed by relationships across systems. The practical conclusion is that teams need unified exposure context before they can claim control over vulnerability risk.
Exposure-path compression: AI-assisted development and attacker automation are shrinking the time between disclosure and exploitation faster than traditional remediation cycles can adapt. That changes the control objective from throughput to traversal resistance, which means the decisive question is whether the environment blocks attack movement before remediation finishes. Security teams should treat path elimination as a core metric, not a secondary outcome.
Metrics must move from activity to effect: patch counts, scan volume, and queue size measure work performed, not risk removed. If those are the only reporting lines, leadership can be misled into thinking the programme is effective while critical routes remain open. The right governance standard is whether the programme is making the environment harder to traverse, and practitioners should report on paths removed and blast radius reduced.
For identity teams, the lesson is immediate: exposure paths often become privilege paths once an attacker reaches a service account, token, or workload identity. Even though the article is broader than NHI, the same logic applies where access is machine-mediated and relationships between assets matter more than standalone findings. Practitioners should treat identity-bound pathways as part of exposure management, not a separate afterthought.
What this signals
Attack-path control has become the more accurate governance unit than vulnerability volume. In modern environments, the security team cannot infer risk reduction from ticket closure alone, because reachable routes to sensitive assets matter more than the raw number of CVEs processed. The programme signal to watch is whether the environment is becoming harder to traverse, not just easier to report on.
Exposure debt accumulates wherever discovery is slower than change. Hybrid estates, ephemeral workloads, and code-driven deployment make stale inventory an operational certainty unless discovery is continuous. For practitioners, the warning is simple: every unobserved asset is a potential blind spot in the path model, so coverage quality becomes a board-level issue.
Identity-bound routes now sit inside exposure management. When attackers can move from a vulnerable service to a token, service account, or workload identity, the vulnerability programme has crossed into IAM territory. That means exposure work and identity governance can no longer be treated as parallel tracks; they must share the same risk picture.
For practitioners
- Consolidate exposure data across tools Normalize findings from scanners, cloud platforms, code repositories, and runtime telemetry into a single exposure model so path analysis has complete inputs.
- Prioritise attack paths, not vulnerability lists Rank remediation by routes to crown-jewel assets, taking privilege, network reachability, and business criticality into account instead of severity alone.
- Add continuous discovery for ephemeral assets Track containers, serverless functions, and temporary environments continuously so short-lived resources are not absent from the risk model between scans.
- Feed exploitability intelligence into triage Use KEV status, proof-of-concept availability, and patch readiness to separate theoretical backlog from vulnerabilities that are actively dangerous now.
- Measure paths removed and blast radius reduced Report whether the programme is eliminating traversable routes to critical systems and shrinking the impact of a successful foothold, not just closing tickets.
Key takeaways
- Traditional vulnerability management is failing because it counts findings while attackers target traversable paths to critical assets.
- The article’s evidence points to a scale-and-speed problem, with 48,000 CVEs in 2025 and exploitation averaging 20 hours from disclosure.
- Programs need continuous discovery, exploitability intelligence, and path-based prioritisation if they want to reduce real exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | Inventory gaps are central when ephemeral assets fall through scan-based coverage. |
| ID.RA-05 — Threats, vulnerabilities, likelihoods, and impacts are used to understand risk | The article argues for exploitability and context, not severity scores alone. | |
| DE.CM-01 — Networks and network services are monitored to detect potential cybersecurity events | Continuous discovery and monitoring underpin path-aware exposure control. | |
| Recommendation — Inventory assets continuously so vulnerability and exposure decisions reflect the current environment. Use contextual risk inputs to rank remediation by likely impact instead of raw vulnerability volume. Monitor environments continuously so newly exposed assets and services are visible before attackers exploit them. | ||
| MITRE ATT&CK | TA0001;TA0004;TA0008 — Initial Access; Privilege Escalation; Lateral Movement | The article’s attack-path model aligns with adversary movement from exposure to impact. |
| Recommendation — Map likely attacker movement to ATT&CK tactics and block the shortest route to critical assets. | ||
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | Incomplete asset inventory is the root cause of missed exposure paths in ephemeral environments. |
| Recommendation — Strengthen asset inventory so short-lived systems are included in exposure assessments. | ||
Key terms
- Attack path: A sequence of identities, permissions, systems, and data stores that an attacker can traverse after obtaining trusted access. In practice, attack paths matter more than single accounts because they show how a low-risk identity can become a route to high-value exposure.
- Exposure management: Exposure management is the practice of identifying which assets are reachable by attackers and reducing that reach before exploitation occurs. For collaboration systems like SharePoint, it is not enough to know that a patch exists, because public accessibility changes the speed and likelihood of attack.
- Continuous discovery: Continuous discovery is the ongoing process of detecting identities as they appear, change, or disappear across environments. For AI agents and other NHIs, it prevents inventory drift and keeps ownership, privilege, and lifecycle controls aligned with the live environment.
- Exploit Intelligence: Actionable information about which vulnerabilities are being actively targeted, how attackers are delivering them, and where exploitation is emerging. It turns vulnerability management from static inventory tracking into a dynamic response process that reflects live adversary behaviour.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org