TL;DR: Security programs can improve exposure scores and still leave the attack path that matters untouched, according to Dataminr, because continuous scanning and dollar-based risk models often stop before validating whether live threat activity is actually blocked. Threat-first prioritization now matters more than a longer list of exposures.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Dataminr's blog post: Continuous exposure management and risk quantification stop short when they do not validate live attack paths against current controls and business impact.
Why it matters: IAM, NHI and broader security teams need attack-path validation because a better score does not prove that an active threat route is blocked or that remediation choices are decision-ready.
Context
Continuous threat exposure management is an ongoing way to see what is exposed across a changing environment, but it is still an asset-first model rather than a threat-first one. That matters because exposure counts can improve while the route a real attacker would take remains intact, especially when identity controls and compensating controls are not tested against live activity. Exposure management and CTEM helps frame the difference between finding weaknesses and proving they are closed.
Risk quantification adds a monetary lens to security decisions, but a dollar figure alone does not show whether the relevant control gap is active right now. In practice, security leaders need a view that connects exposure, current adversary behaviour, and operational thresholds so that the business can decide what to fix, defer, or accept.
Key questions
Q: How do I validate attack paths in a CTEM programme?
A: Validate attack paths by starting from a real objective, then tracing reachable steps through identities, permissions, network routes, and exposed services to see whether an attacker can actually progress. Confirm the path with authentication context, privilege boundaries, and exploitability, then prioritise controls that break the chain, such as removing excessive access, tightening segmentation, or closing the exposed weakness.
Q: Why can risk scores miss live attack paths?
A: Risk scores can miss live attack paths because they usually estimate severity from static asset or vulnerability data, not whether an attacker can combine reachable exposures, valid credentials, and privilege escalation in sequence. A low-scoring issue can still sit on a complete route to a sensitive system if trust relationships and access paths are intact.
Q: How does exposure management differ from attack-path validation?
A: Exposure management identifies and ranks weaknesses, misconfigurations, and reachable assets, while attack-path validation proves whether those exposures form a usable route to a valuable target. The first is broader and often inventory-led. The second is path-specific and checks whether identities, privileges, segmentation, and exploit conditions actually connect into a compromise path.
Q: When should teams accept an exposure instead of fixing it?
A: Teams accept an exposure when the residual risk stays below the business threshold after considering likelihood, impact, compensating controls, and the cost or delay of remediation. That decision should be explicit, time-bound, and owned, with monitoring, a review date, and a record of why the exposure is being tolerated rather than fixed.
Technical breakdown
Why exposure-led prioritisation misses attack paths
Exposure-led prioritisation starts with assets, weaknesses, and severity scores, then ranks what to fix next. That approach is useful for visibility, but it does not answer whether a real attacker can move through the environment and reach a business-critical outcome. The limitation is structural: a program can improve every exposure metric and still leave the specific path that matters untouched. In identity-rich environments, that gap often shows up where access, privilege, and lateral movement are chained together rather than exploited as isolated flaws. See the Exposure Management and CTEM Guide.
Practical implication: Validate whether a live attack path still exists before treating a reduction in exposure count as risk reduction.
Why risk quantification alone is not operationally current
Risk quantification converts security posture into dollars, which is useful for board discussion and prioritisation. But most scoring models are only as current as the data inputs they consume, and many do not continuously fuse live threat-actor activity with present-day compensating controls. That means the number can be defensible without being timely. A static monetary estimate is not the same as a current operational judgement, especially when threat activity and control effectiveness change faster than quarterly review cycles.
Practical implication: Recalibrate risk scoring with live threat and control data before using it to justify deferral or acceptance decisions.
What predictive threat exposure management adds
Predictive Threat Exposure Management ties together live threat activity, compensating controls, and business impact in one continuously updated view. The point is not to generate another list, but to make the score conditional on whether the threat is active, whether controls already block it, and what the organisation would lose if they did not. That shifts the unit of analysis from generic weakness to decision-ready exposure. The model becomes more relevant where the security question is not ‘what is vulnerable?’ but ‘what is exposed to an active threat that still matters to the business?’
Practical implication: Use a threat-first model when remediation and acceptance decisions must account for current adversary behaviour.
Threat narrative
Attacker objective: The attacker objective is to reach a business-impacting path that the organisation has not actually broken, even if its exposure metrics look improved.
- Entry begins when an active threat path is identified through exposed assets or a chain of weaknesses that ranking alone did not surface.
- Escalation follows when the attacker reaches a control gap that is not being validated against live behaviour, allowing the path to remain viable.
- Impact occurs when the organisation closes many exposures but leaves the material route to business harm intact.
Breaches seen in the wild
- Gravity SMTP CVE-2026-4020 API Keys Exposure: CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Attack-path validation is the missing governance layer: exposure management can tell teams what is open, but not whether the route a real attacker would use has been broken. That makes exposure counts a partial control signal rather than a governance answer. For IAM, PAM and NHI programmes, the key question is whether privilege pathways and compensating controls have been tested against a live threat model, not whether the inventory looks cleaner.
Risk quantification becomes useful only when it is operationally current: a dollar figure helps boards and insurers, but it loses value when it is detached from present threat activity and present control state. Security leaders need a quantified view that changes as the attack surface and defensive posture change. Otherwise, they end up defending a number instead of a decision.
Threat-first prioritisation changes remediation economics: the article’s core point is that a vulnerability queue is not a threat queue. That distinction matters because many organisations still treat reduction in findings as reduction in risk. In reality, the risk falls only when the attack path is broken, and that requires a named concept here: decision-ready exposure, where exposure, control status and business impact are bound together.
Traceability is now a security requirement, not a reporting luxury: leaders increasingly need to explain why one exposure was fixed, another deferred, and a third accepted. That means linking a specific threat, a specific control gap, and a specific business threshold into one auditable decision path. For practitioners, the governance test is whether the programme can show its work end to end.
What this signals
Decision-ready exposure: the useful unit is no longer a weakness or a score, but an exposure that has been tested against current control state and an explicit business threshold. That will push security programmes toward evidence of blocked attack paths, not just cleaner dashboards.
For identity-heavy environments, the next step is to connect exposure management to privilege pathways, third-party access and compensating controls so remediation reflects how attackers actually move. The programme that can show why a path is closed will outlast the one that only shows how many issues were found.
For practitioners
- Build attack-path validation into remediation triage Rank exposures only after checking whether the most likely attacker path is still open and whether current controls actually block it.
- Tie risk scores to live control state Refresh quantified risk views with current compensating controls and live threat activity before using them for board or funding decisions.
- Define acceptance thresholds in advance Set decision thresholds for fix, defer, or accept so the team can act consistently when a quantified exposure crosses a business limit.
- Separate exposure counts from business impact Report the number of weaknesses and the attack paths that matter as different measures, so remediation work is driven by real consequence rather than metric movement.
Key takeaways
- Exposure management can improve visibility without proving that the attacker route to impact has been broken.
- Risk quantification is useful for decision-making, but only when it reflects live threat activity and current controls.
- Practitioners should validate attack paths and set acceptance thresholds before treating remediation metrics as evidence of reduced risk.
Related NHI Mgmt Group resources: Exposure Management and CTEM Guide · Identity and NHI Security Business Case Guide · Exposure Management Maturity Model
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical Devices and Systems Inventoried | Exposure-led prioritisation starts with inventory and visibility across changing assets. |
| ID.RA-05 — Threats, Vulnerabilities, Likelihoods, and Impacts Used to Determine Risk | The article hinges on combining threat activity with impact instead of severity alone. | |
| Recommendation — Maintain current asset and exposure inventories before prioritising remediation decisions. Use live threat and impact data together when scoring and prioritising exposure risk. | ||
| MITRE ATT&CK | TA0007;TA0008 — Discovery; Lateral Movement | Attack-path validation is about the routes adversaries use to discover and move through environments. |
| Recommendation — Map exposure findings to discovery and lateral-movement techniques to test whether paths remain usable. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Continuous exposure management is directly about prioritising and managing vulnerabilities at scale. |
| Recommendation — Run continuous vulnerability management with prioritisation that reflects active attack paths, not only severity. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | The post discusses ongoing exposure detection and the need to validate whether findings are exploitable. |
| Recommendation — Pair vulnerability monitoring with validation that confirms whether the exposure is actually reachable. | ||
Key terms
- Attack path: A sequence of identities, permissions, systems, and data stores that an attacker can traverse after obtaining trusted access. In practice, attack paths matter more than single accounts because they show how a low-risk identity can become a route to high-value exposure.
- Threat Exposure Management: Threat Exposure Management is the continuous process of finding, prioritizing, and reducing an organization’s attack surface before it is exploited. It combines asset visibility, vulnerability analysis, misconfiguration review, identity risk, and adversary-focused validation to show where exposure exists, how it can be reached, and what remediation will most reduce risk.
- Continuous Threat Exposure Management: Continuous Threat Exposure Management is the ongoing process of finding which assets, identities, and paths are actually reachable from the current environment. It moves risk assessment away from static inventories and toward live exposure, so security teams can prioritise what an attacker or misuse path can reach now.
- Risk Quantification: Risk quantification is the practice of expressing security exposure in financial or business terms so leaders can compare priorities consistently. In identity programmes, it links access issues, control failures, and policy exceptions to likely loss, operational disruption, or compliance cost.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity control decisions to the wider security programme.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org