Topic starter
19/08/2026 3:49 pm
TL;DR: AI is now used by 88% of organisations in exposure management, yet 61% still leave more than a quarter of findings unresolved because AI is concentrated in prioritisation rather than execution, according to Seemplicity. The governance gap is not insight quality but ownership, routing, and fix-ready delivery.
Editorial analysis by NHI Mgmt Group, based on content published by Seemplicity: “Why AI Alone Isn’t Improving Vulnerability Remediation”.
By the numbers:
- 88% of organizations now use AI in exposure management, highlighting widespread adoption across the industry.
- 61% of organizations say more than a quarter of their findings remain unresolved.
- 59% of organizations rely on collaborative ownership models to assign a security issue to a fixing team.
Key questions
Q: What breaks when AI is used for vulnerability triage without validation?
A: Without validation, AI triage can change its answers across runs or model updates, which breaks consistency, auditability, and trust.
Q: Why do unresolved findings persist even when teams use AI?
A: Unresolved findings persist because AI is often placed where it is safest, in analysis and recommendation, while execution still relies on manual coordination.
Q: What are the signs that remediation automation is failing?
A: The clearest signs are high backlog age, repeated reassignment, inconsistent ticket detail, and findings that remain open after prioritisation.
Practitioner guidance
- Define accountable owner mapping for every finding Map each asset type to a default fixing team and require exception handling only when the asset-owner relationship is genuinely unclear.
- Convert findings into fix-ready tasks Include root cause, recommended change, and implementation context in the work item before it reaches engineering queues.
- Standardise remediation workflows across teams Replace ad-hoc handoffs with a consistent intake, triage, assignment, and closure sequence that can be measured end to end.
Bottom line: AI can improve exposure management decisions without materially improving remediation if ownership and routing remain manual.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:25 pm
Execution debt is the real exposure-management failure mode. AI has already been adopted widely in analysis and prioritisation, but that does not close the loop on remediation. The article shows that organisations can become better at deciding what matters while remaining slow at making anything change. The discipline problem is not more insight; it is more reliable conversion from decision to closure.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do security teams know if AI is improving vulnerability management?
A: AI is working when it improves decision quality, not just throughput. Look for faster identification of exposed assets, better prioritisation of exploitable findings, and fewer critical paths remaining after remediation. If the output is just a bigger queue processed faster, the programme has not changed.
👉 Read our full editorial: AI-driven vulnerability remediation still fails at execution