Kenna’s retirement signals exposure management’s shift beyond RBVM

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Tonic's blog post: Cisco's retirement of Kenna Security marks the end of a widely influential RBVM era and the rise of exposure management that prioritises context, business impact, and remediation outcomes.

Why it matters: Identity, asset, and exposure governance are converging, so vulnerability teams now have to think beyond finding issues and toward preserving context, ownership, and remediation flow across hybrid environments.

Context

Exposure management is what happens when vulnerability management stops being a useful enough operating model. Scanning and CVSS ranking can surface issues, but they do not explain which exposures matter most, which controls change the outcome, or how risk moves across assets and identities in a hybrid estate.

This article is about the governance gap between finding weaknesses and reducing exposure. That gap matters to IAM and NHI programmes because ownership, remediation, and attack-path context increasingly depend on identity signals, not just asset inventories or severity scores.

Key questions

Q: What breaks when organisations still rely on severity-only vulnerability management?

A: They fix the wrong things first. Severity-only models miss whether an issue is reachable, already exploited, or likely to be automated by attackers, so limited effort gets spent on lower-value work while high-risk exposure persists. In fast-moving environments, that gap is enough to turn disclosure into compromise.

Q: Why does contextual prioritisation matter for remediation teams?

A: Contextual prioritisation matters because the same vulnerability can have very different risk depending on asset criticality, privilege, compensating controls, and business service impact. Without that context, teams waste effort on low-value work and miss exposures that are easier to exploit or more damaging if abused.

Q: What are the signs that contextual exposure management is failing?

A: Common signs include overwhelming issue volumes, repeated false positives, slow escalation to the right owners, and remediation efforts aimed at the wrong assets. If teams cannot distinguish a critical customer facing system from an isolated low value environment, their exposure programme is probably too flat. Another warning sign is when security, IT, and business teams stay misaligned about what should be fixed first.

Q: Should organisations replace RBVM with continuous exposure management?

A: Yes, when RBVM no longer reflects the pace or complexity of the environment. Continuous exposure management is better suited to hybrid estates, shared controls, and business-driven remediation because it measures exposure as a moving condition rather than a static vulnerability list.

Technical breakdown

Why RBVM stopped short of exposure management

Risk-based vulnerability management improved on raw CVSS by adding exploitability and asset importance, but it still treated the vulnerability as the unit of work. That works until environments become too dynamic, the asset map becomes incomplete, and manual interpretation slows response. Exposure management shifts the unit of analysis from the finding itself to the path, control state, and business impact surrounding it. In practice, that means remediation decisions depend on more than severity: they require context about where the issue sits, what else protects it, and what an attacker could chain next.

Practical implication: Treat vulnerability scores as inputs to a broader exposure decision, not as the decision itself.

How contextual exposure changes prioritisation

Contextual prioritisation connects vulnerabilities to asset criticality, ownership, control coverage, and likely attack paths. That is materially different from ranking every issue by a static score because the same weakness can represent very different risk in different environments. This is also where identity becomes relevant: privileged access, service accounts, and remediation ownership shape whether a weakness is exploitable or quickly containable. Exposure management therefore depends on an asset graph, not just a ticket queue, and on the ability to preserve business context as systems and teams change.

Practical implication: Build prioritisation around ownership, privilege, and attack-path context rather than severity alone.

What agentic remediation changes in the operating model

Agentic exposure management goes beyond recommending what to fix and starts orchestrating the work. That means identifying the right fixer, opening or updating tickets, enforcing policies, tracking progress, and validating that the control change actually reduced exposure. The technical shift is from reporting to action, with automation operating across asset, control, and workflow systems. For identity teams, this is significant because the same model can drive changes to access, exceptions, and compensating controls when those are part of the exposure path. The challenge is to automate without losing auditability or governance.

Practical implication: Use automation only where remediation, validation, and exception handling are measurable and auditable.

NHI Mgmt Group analysis

Exposure management is replacing vulnerability counts as the organising logic for remediation. Counting findings was always a proxy for risk, not risk itself. Once asset sprawl, hybrid infrastructure, and business-critical dependencies enter the picture, the control question changes from “what exists?” to “what exposure can actually be exploited?” Practitioners should treat this as a governance reset, not a tooling refresh.

Context is now the control plane. The article’s core shift is that prioritisation must include ownership, control coverage, remediation feasibility, and business impact. That aligns closely with identity governance, because access paths, service accounts, and exception ownership often decide whether an exposure remains theoretical or becomes actionable. Teams that cannot preserve that context will keep rebuilding the same risk decisions in spreadsheets.

Agentic exposure management names a new operational boundary. The next category is not just faster triage. It is managed action across discovery, prioritisation, ticketing, exceptions, and validation. The named concept here is context-preservation debt: the risk that migrations, tool changes, or workflow resets erase the institutional knowledge needed to reduce exposure effectively. Practitioners should measure whether their programme can carry context forward as well as it carries data.

This shift validates continuous exposure management, but it also exposes weak operating models. If teams still rely on severity-only queues, manual exception tracking, or fragmented asset views, they are already behind the control model implied here. The practical conclusion is straightforward: programmes need a repeatable way to tie exposures to business services, ownership, and remediation outcomes.

What this signals

Context-preservation debt: the real migration risk is not data loss, but the loss of ownership, exception history, and prioritisation logic that makes remediation decisions defensible. When that context disappears, teams rebuild risk decisions manually and the programme slows down.

Exposure management will keep moving toward orchestration because the value is no longer in surfacing findings, but in proving that a control change reduced exposure. For practitioners, that means remediation workflows, validation, and exception handling have to become first-class governance objects.

For practitioners

• Preserve remediation context during migrations Carry forward ownership, exception rationale, tags, risk acceptance, and prioritisation logic so the programme does not reset when the platform changes.
• Prioritise by attack path and business impact Rank exposures using asset criticality, likely exploitation paths, and the controls that already reduce or amplify the exposure.
• Validate queue parity before cutover Run the old and new workflows in parallel long enough to compare deduplication, asset matching, and ticket routing outcomes.
• Keep identity ownership in the exposure graph Link service accounts, privileged access, and remediation owners to the same asset and control model so teams can see who can act and why.
• Measure remediation outcomes, not just backlog size Track MTTR, SLA compliance, recurrence, and accepted risk trends to prove that the programme is reducing exposure rather than simply moving tickets.

Key takeaways

• RBVM improved prioritisation, but it still treated vulnerabilities as the main unit of risk, which is no longer enough for modern hybrid environments.
• The key evidence in this article is category shift, not just product sunset: teams now need context, ownership, and remediation orchestration to reduce exposure.
• Programmes that preserve context across migration are better positioned to move from backlog management to measurable exposure reduction.

Key terms

• Risk-based Vulnerability Prioritisation: A method of ordering remediation by how likely a flaw is to be exploited in the real world, not just by how severe it looks on paper. It combines exposure, exploit activity, asset importance, and automation potential to focus limited effort where attackers are most likely to succeed.
• Continuous Exposure Control: A governance model that treats application exposure as a live condition rather than a one-time assessment result. It links scanning, release changes and runtime verification so teams can see when public-facing risk reappears after deployment or integration drift.
• Agentic Exposure Management: A continuous exposure workflow that collects signals from security, cloud, identity, and operational systems, then uses automation to assign, route, and verify remediation. The emphasis is on closure and feedback, not simply generating more findings or more tickets.
• Context Preservation: Context preservation is the practice of carrying identity-like attributes such as hostnames, device IDs, cloud tags, and service labels through every processing stage. It ensures events remain attributable and searchable across tools, which is essential for correlation, filtering, and investigation.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.