Risk-based vulnerability management now outranks severity scores

At a glance

What this is: CISA’s new directive pushes vulnerability management toward exploit likelihood and real-world attacker activity instead of relying on severity scores alone.

Why it matters: For IAM, NHI, and security teams, the shift matters because remediation priority increasingly depends on exposure, abuse potential, and how quickly adversaries can operationalise a flaw.

👉 Read Proofpoint's analysis of CISA BOD 26-04 and risk-based vulnerability management

Context

Vulnerability management is really a prioritisation problem: defenders cannot fix everything at once, so the control question becomes which exposures are most likely to be used in an attack. CVSS helps rank severity, but it does not tell teams whether a flaw is internet-facing, already exploited, or easily automatable at scale.

This topic matters to identity programmes because exploitation often turns into credential abuse, privilege escalation, and access expansion once a vulnerability is weaponised. In environments that combine human access, service accounts, and NHI, remediation decisions affect more than patch queues. They shape the blast radius available to attackers and the speed at which trust boundaries fail.

CISA’s approach also reinforces a broader operational reality: exposure management works best when vulnerability data is paired with adversary intelligence. That is as true for patching as it is for secrets governance and privileged access, where the same principle applies. Prioritise the controls that shrink attacker opportunity, not just the controls that look worst on paper.

Key questions

Q: What breaks when vulnerability management is based only on CVSS scores?

A: CVSS-only prioritisation breaks when several lower-scoring flaws can be combined into a complete exploit path. In that model, the real risk is not one critical CVE but the sequence of reachable weaknesses across connected assets. Teams need to rank exposure by exploit path and blast radius, not by a flat severity list alone.

Q: Why do exploited systems create more identity risk than patching teams usually expect?

A: Exploited systems often hold credentials, privileged accounts, or trust relationships that are more valuable than the original flaw. That is why exploitation frequently leads to account abuse, reconnaissance, and credential theft. The risk is not only code execution. It is the exposed identity surface that sits behind the code.

Q: How do security teams know if exploitation-based prioritisation is working?

A: Look for a shorter must-fix list, fewer exposed KEV items, faster closure of actively exploited CVEs, and clearer ownership for the devices or applications that stay open longest. Good prioritisation reduces the number of exceptions that survive month to month. If the queue still grows without changing which items get fixed first, the model is not working.

Q: Who is accountable when a known exploited Office vulnerability remains unpatched?

A: Accountability sits with the owners of endpoint patching, email security, and privileged workstation governance, because the exposure spans all three. When a CVE is in KEV and patches are available, delayed remediation becomes a governance failure as well as a technical one. CISA deadlines and internal patch SLAs should be aligned to that reality.

Technical breakdown

Why CVSS alone misses exploitation reality

CVSS is a severity model, not an attacker model. It tells you how bad a flaw could be if fully exploited, but it does not capture whether the asset is internet-facing, whether exploit code is circulating, or whether attackers can automate abuse across many targets. That distinction matters because exploitation timing, exposure surface, and operational feasibility determine real risk. In practice, a medium-scoring flaw on a public-facing system can be more dangerous than a high-scoring issue on an isolated host.

Practical implication: tune remediation queues around exploitability and exposure, not score alone.

How exploit intelligence changes the patching window

Exploit intelligence reduces the blind spot between disclosure and patch completion. Once a vulnerability is known to be targeted in the wild, the problem is no longer theoretical. Teams need to account for patch deployment lag, compensating controls, and the fact that adversaries often move faster than standard maintenance cycles. This is especially relevant where identity controls or secrets are involved, because a single successful exploit can expose sessions, tokens, or administrative paths that outlive the original flaw.

Practical implication: use active exploitation signals to decide where compensating controls must hold the line before patching finishes.

Why first-mile detection matters for vulnerability defence

First-mile detection focuses on the delivery stage, before payload execution or endpoint compromise. In exploit-driven campaigns, that may mean malicious email, web delivery, or another initial access path that carries the exploit toward the target. Catching activity here gives defenders a chance to stop the chain before a vulnerability becomes a breach. For identity-heavy environments, that early intervention can prevent token theft, account takeover, or privilege abuse that would otherwise follow exploitation.

Practical implication: extend detection upstream so exploit attempts are interrupted before they can trigger identity abuse.

Threat narrative

Attacker objective: The attacker wants to turn a newly disclosed vulnerability into a fast, low-effort path to durable access or operational disruption.

1. Entry begins when attackers target internet-facing systems or delivery paths carrying a known exploit.
2. Escalation follows when the flaw is used to execute code, harvest credentials, or open a foothold for lateral movement.
3. Impact occurs when the attacker converts that foothold into data theft, service disruption, or privileged access expansion.

NHI Mgmt Group analysis

Risk-based remediation is now an identity governance issue, not just a vulnerability management issue. Once an exploit turns into credential theft, session compromise, or privilege escalation, the relevant control surface is no longer only patching. It becomes the interaction between exposure management, authentication, and privilege boundaries. That is why security leaders should treat exploit intelligence as input to IAM and PAM decisions, not as a separate operations feed.

Exploit likelihood is a better prioritisation primitive than theoretical severity. A score describes potential impact, but it does not describe whether adversaries are actively weaponising the flaw or whether the vulnerable asset is reachable from the internet. CISA’s direction reflects what defenders already know in practice: probability and exposure drive the queue. Practitioners should use that principle to focus limited response capacity where attack paths are most realistic.

Standing access makes vulnerability exploitation more expensive to defend. When systems, service accounts, or NHI retain persistent privileges, a successful exploit can turn a single entry point into broader movement and longer dwell time. That is the governance problem this shift surfaces: remediation speed matters, but so does reducing what the attacker can do during the patch window. Teams should pair exposure triage with tighter privilege scope and session boundaries.

Exploit intelligence creates a more honest operating model for security operations. The article points to a gap many programmes still have: they know what is vulnerable, but not what is being actively targeted. That gap causes overreaction to low-probability issues and underreaction to weaponised ones. Mature governance aligns patch priority, compensating controls, and access restriction to observed attacker behaviour, not just scanner output.

Blast-radius control is the real differentiator when patching cannot be immediate. If remediation takes days or weeks, the best defence is to make exploitation materially less useful through segmentation, privilege minimisation, and rapid containment. That position applies equally to NHI and human access. Practitioners should interpret this directive as a call to reduce what a successful exploit can reach, not just to shorten the patch queue.

What this signals

Exploit-driven prioritisation will keep pushing identity teams closer to vulnerability operations. Once patch queues are ranked by real attack activity, the adjacent question becomes which identities, secrets, and administrative paths can be removed from the blast radius before remediation completes. That means tighter privilege boundaries, shorter-lived access, and faster offboarding need to be treated as part of exposure management, not separate hygiene work.

Standing access is the hidden accelerator in exploit windows. If a disclosed flaw can be turned into long-lived access, the remediation delay becomes much more expensive. Teams should expect more overlap between vulnerability operations and NHI lifecycle controls, especially where service accounts, API keys, and administrative tokens can be reached through compromised systems.

The strongest response combines outside-in exploitation data with inside-out governance. Pair active exploit monitoring with the NHI Lifecycle Management Guide mindset: reduce what can be reached, rotate what can be abused, and remove persistence paths that survive patch cycles.

For practitioners

• Rebuild patch triage around exploitability Rank vulnerabilities by internet exposure, evidence of exploitation in the wild, and automation potential before using CVSS as a secondary tie-breaker.
• Link vulnerability queues to IAM and PAM controls When a vulnerable asset can expose accounts, tokens, or administrative paths, require access restriction or step-up controls before patch completion.
• Use compensating controls during patch windows Apply segmentation, filtering, and temporary hardening to reduce exposure while updates move through distributed environments.
• Prioritise first-mile detection for active exploit paths Tune monitoring so exploit delivery attempts are detected before payload execution, especially for email and web entry points.

Key takeaways

• CISA’s directive reflects a practical shift from theoretical severity to observed exploitation, which changes how remediation queues should be built.
• The real risk is not the vulnerability score alone but the chance that a public-facing flaw can become credential abuse, privilege escalation, or broader access.
• Security teams need exploit intelligence, compensating controls, and identity-aware blast-radius reduction to stay ahead of patching delays.

Key terms

• Risk-based Vulnerability Prioritisation: A method of ordering remediation by how likely a flaw is to be exploited in the real world, not just by how severe it looks on paper. It combines exposure, exploit activity, asset importance, and automation potential to focus limited effort where attackers are most likely to succeed.
• First-mile Detection: Detection that occurs at the earliest delivery point of an attack, before payload execution or endpoint compromise. In practice, this means spotting malicious email, web delivery, or other entry vectors early enough to stop exploitation before it turns into access or persistence.
• Compensating Control: A compensating control is a measure that reduces risk when the ideal fix, such as immediate patching or redesign, is not possible. In OT, compensating controls often include session recording, access restriction, and tighter monitoring. They do not eliminate the underlying issue, but they narrow exposure until safer remediation can happen.
• Exploit Intelligence: Actionable information about which vulnerabilities are being actively targeted, how attackers are delivering them, and where exploitation is emerging. It turns vulnerability management from static inventory tracking into a dynamic response process that reflects live adversary behaviour.

What's in the full article

Proofpoint's full blog covers the operational detail this post intentionally leaves for the source:

• How Active Exploits Protection correlates observed attacker behaviour with vulnerability priority decisions across email and network traffic.
• The article's explanation of how first-mile visibility helps teams reduce exposure during patching windows before payload execution.
• The operational framing behind CISA BOD 26-04 and why exploit intelligence changes security operations triage.
• Proofpoint's examples of how teams can distinguish urgent exposures from lower-priority scanner findings.

👉 Proofpoint's full blog covers exploit-intelligence prioritisation, first-mile detection, and remediation window reduction.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and identity lifecycle control. It helps practitioners connect identity risk to the broader security programme that depends on it.