CVE counts miss exposure: why attack-path risk matters more

At a glance

What this is: This is an analysis of why CVE counts and CVSS scores often fail as risk metrics, and why attack-path validation gives a truer picture of exposure.

Why it matters: It matters because IAM, PAM, and broader security teams need measures that reflect real access pathways, not just ticket closure volume or theoretical severity.

By the numbers:

• Only about 4% of CVEs scored 7.0 or higher were observed in exploitation attempts.
• In 2026, analysts are forecasting some 59,427 new CVEs.
• Just 1% of CVEs were exploited in the wild in 2025.

👉 Read XM Cyber's analysis of why CVE counts miss real exposure

Context

CVE counts are easy to report, but they are a poor proxy for exposure because they ignore whether a weakness is reachable, chained, or tied to anything attackers actually target. In practice, teams can close high-severity tickets and still leave internet-facing attack paths open, especially when identity controls, network exposure, and privilege scope are not part of the prioritisation model.

This gap matters across IAM and identity-adjacent security work because the real question is often not whether a flaw exists, but whether an attacker can use it to reach privileged access, service accounts, or sensitive systems. That makes exposure management a governance issue as much as a technical one, particularly in environments where non-human identities and access paths change faster than ticket queues.

The pattern described here is typical in large enterprises: compliance-friendly metrics survive because they are simple to collect, even when they fail to describe actual risk.

Key questions

Q: How should security teams prioritise vulnerabilities when business impact matters more than severity scores?

A: Prioritise by combining exploitability, asset criticality, compensating controls, and process ownership. A medium severity flaw on a revenue system may be more urgent than a critical flaw in a lab environment. The goal is to decide which exposure can create the biggest business loss fastest, then remediate that first.

Q: Why do CVE counts and CVSS scores fail as board risk metrics?

A: They fail because they describe technical severity, not business loss. A low-rated issue in a critical payment workload can cost far more than a high-rated issue in a development container, especially when weaponization is fast and runtime exposure is long. Boards need risk expressed in dollars, not defect tallies, if they are going to compare cyber exposure with other enterprise risks.

Q: What do vulnerability programmes get wrong about severity-based SLAs?

A: Severity-based SLAs assume that higher scores always deserve faster remediation, but that ignores asset context and attacker behaviour. In practice, the most dangerous issue is often the one that creates a direct route to a high-value system. Programmes should use SLAs as a control input, not as the entire risk model.

Q: How do organisations know remediation is actually reducing exposure?

A: They should measure time to closure, percentage of issues resolved within SLA, escalation rates, and the share of findings that require security-led fallback. If findings are assigned but remain open, the programme is reporting activity rather than reducing risk. Closure evidence matters as much as detection volume.

Technical breakdown

Why CVSS severity is not the same as exploit risk

CVSS is a scoring model for the theoretical impact of a vulnerability in isolation. It tells you how severe a flaw could be under standard assumptions, but it does not tell you whether the vulnerable asset is internet-facing, whether compensating controls exist, or whether the issue sits on a practical attacker route to something valuable. That is why a 9.8 score in a lab can matter less than a lower-rated flaw in a public authentication service. Risk emerges from context, not score alone.

Practical implication: prioritise vulnerability decisions using reachability, exposure, and asset criticality, not CVSS alone.

Why CVE volume overwhelms remediation queues

CVE volume is now large enough that remediation teams cannot treat every finding as equally actionable. Once alert and ticket volume rises into the tens of thousands, triage models that rely on severity thresholds become mechanically efficient but strategically weak. They optimise for closure rates rather than for the elimination of viable attack paths. This is especially problematic when enrichment pipelines are incomplete, because the queue starts reflecting what is easiest to ingest rather than what is most dangerous.

Practical implication: build prioritisation around validated exposure paths, not around the size of the backlog.

How continuous exposure management changes the metric

Continuous Exposure Management shifts the unit of measurement from isolated vulnerabilities to end-to-end attack paths. Instead of asking how many CVEs were remediated, it asks whether an attacker can still move from an entry point to a critical asset through a chain of reachable weaknesses, misconfigurations, or excessive privileges. That makes the model closer to adversary behaviour and better aligned with how privilege, identity, and infrastructure actually interact in modern environments.

Practical implication: validate whether critical assets are reachable through real attack chains before you decide what to fix first.

Threat narrative

Attacker objective: The attacker’s objective is to reach critical assets through the shortest viable path, not to exploit the highest-scoring vulnerability on a dashboard.

1. Entry occurs through an exposed weakness, misconfiguration, or identity path that a scanner may not rank highest.
2. Escalation follows when the attacker chains reachable issues or over-permissioned access to move toward more valuable systems.
3. Impact occurs when a business-critical asset is reached through an attack path that the CVE count never distinguished from lower-value findings.

NHI Mgmt Group analysis

CVSS-driven remediation creates severity theatre. When teams optimise for scores, they can produce cleaner dashboards without reducing exposure. CVSS was never designed to answer whether a flaw is reachable, chained, or connected to privileged access. The result is a governance model that rewards ticket volume and SLA compliance while leaving the actual attack surface intact. For practitioners, the decisive question is whether remediation changes attacker options.

Attack-path validation is the more useful governance unit. Security programmes should measure whether an adversary can move from initial access to sensitive assets, not whether a vulnerability clears a numeric threshold. That approach aligns better with NIST Cybersecurity Framework 2.0 and NIST SP 800-53 Rev 5 control thinking, because both emphasise risk management in context rather than isolated defect counting. For practitioners, the right metric is whether an attack path still exists.

Identity and privilege are part of vulnerability prioritisation, not a separate problem. Misconfigured access, cached credentials, and over-permissioned service accounts often create the exploitable path that CVE reporting misses. In NHI-heavy environments, the most dangerous exposure may be an identity control failure that turns a moderate issue into a direct route to production systems. For practitioners, vulnerability management and identity governance need to share the same prioritisation model.

Exposure management is becoming the bridge between security teams and the business. Boards can understand attack-path reduction more easily than raw CVE closure counts because it maps to what can still be reached, not what has been catalogued. That makes it a stronger reporting line for leadership decisions about remediation investment, staffing, and compensating controls. For practitioners, the measurement conversation should move from how much was fixed to what was still reachable.

Validated context is the named concept this article reinforces. A vulnerability only becomes a real risk when reachability, privilege, and business criticality are validated together. Without that context, prioritisation becomes an administrative exercise rather than an adversary-informed security function. For practitioners, validated context should sit at the centre of exposure governance.

What this signals

The programme implication is straightforward: vulnerability management and identity governance can no longer operate as separate queues. If service accounts, API keys, and third-party access are invisible, the team may be optimising CVE closure while leaving the most practical routes to impact untouched. The control question is not how many findings were closed, but whether the path to critical assets is actually shrinking.

Validated exposure paths: this should become the working concept for teams that still rely on severity-led prioritisation. When access scope, asset reachability, and business value are assessed together, remediation decisions become far more defensible to executives and auditors. For practitioners, that means linking scanner data with identity, privilege, and asset inventories.

The governance signal is that exposure management is maturing into a cross-domain discipline. For identity teams, that means bringing service-account visibility, privilege scope, and third-party access into the same reporting model as vulnerability remediation, supported by NIST Cybersecurity Framework 2.0 and NIST SP 800-53 Rev 5.

For practitioners

• Replace CVE-only prioritisation with attack-path scoring Classify findings by whether they are actually reachable, whether the affected system is internet-facing, and whether a known route exists to critical assets. Use that ranking to decide remediation order instead of raw CVSS thresholds.
• Tie vulnerability triage to identity and privilege data Join scanner output with service account scope, cached credentials, third-party access, and network exposure so that a moderate flaw on a privileged path outranks a critical flaw in an isolated segment.
• Measure closed attack paths, not closed tickets Report how many validated routes to crown-jewel assets were removed each quarter and how many remain. That creates a leadership metric grounded in real reduction of exposure rather than remediation activity.
• Prioritise remediation around externally reachable systems Start with public-facing authentication services, exposed APIs, and other entry points that can connect directly to sensitive assets. Those paths create the highest leverage for attackers and the highest value for defenders.

Key takeaways

• CVE and CVSS reporting can improve hygiene without reducing real risk when they ignore reachability, privilege, and asset context.
• The evidence in this article shows that only a small fraction of high-severity CVEs are observed being exploited, which makes attack-path validation a better prioritisation model.
• Security teams should measure whether validated routes to critical assets are shrinking, because that is the clearest sign that remediation is actually reducing exposure.

Key terms

• Attack path: A sequence of identities, permissions, systems, and data stores that an attacker can traverse after obtaining trusted access. In practice, attack paths matter more than single accounts because they show how a low-risk identity can become a route to high-value exposure.
• Exposure management: Exposure management is the practice of identifying which assets are reachable by attackers and reducing that reach before exploitation occurs. For collaboration systems like SharePoint, it is not enough to know that a patch exists, because public accessibility changes the speed and likelihood of attack.
• Validated Context: Validated context means confirming not just that a weakness exists, but whether it is reachable, exploitable, and connected to important business assets. In modern security programmes, this context is the difference between administrative cleanliness and genuine risk reduction.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

What's in the full article

XM Cyber's full blog covers the operational detail this post intentionally leaves for the source:

• How the vendor maps validated attack paths into remediation prioritisation workflows for real environments
• Examples of how environmental context changes the ranking of high-CVSS and lower-CVSS findings
• Practical guidance for tying exposure metrics to leadership reporting and remediation SLAs
• Discussion of the control gaps that vulnerability scanners do not capture, including misconfigurations and identity paths

👉 XM Cyber's full post includes the attack-path examples, scoring pitfalls, and leadership metrics behind the argument.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity control decisions to the broader security outcomes their programmes are measured on.