Topic starter
01/08/2026 8:59 pm
TL;DR: Attack-path-led vulnerability management is replacing scan-score-patch thinking with continuous exposure discovery, validation, prioritisation, and remediation because only 26% of KEV vulnerabilities were fully remediated and remediation timelines have reached 43 days, according to XM Cyber and the 2026 Verizon DBIR. The category is shifting toward proving whether a path to critical assets actually exists, not whether a vulnerability is merely present.
Editorial analysis by NHI Mgmt Group, based on content published by XM Cyber: “The VM Category Shift: XM Cyber Wins SC Awards Europe 2026 Best Vulnerability Management Solution”.
By the numbers:
- Only 26% of KEV vulnerabilities were ever fully remediated, according to the 2026 Verizon DBIR cited by XM Cyber.
- Remediation timelines have grown to 43 days, according to the 2026 Verizon DBIR cited by XM Cyber.
Key questions
Q: What breaks when vulnerability management ignores attack paths?
A: When vulnerability management ignores attack paths, teams end up fixing issues that are technically severe but operationally irrelevant while leaving reachable exposures open.
Q: Why do reachable vulnerabilities create more risk than severity scores suggest?
A: Because exploitability depends on context, not just the label.
Q: How can teams tell whether attack-path-led VM is actually working?
A: It is working when remediation reduces the number of viable routes to critical assets and retesting proves those routes are gone.
Practitioner guidance
- Map remediation to reachable attack paths Use attack graphs or equivalent validation methods to prioritise findings only when they sit on a route to a critical asset, not merely because they score high.
- Validate every closure before ticket sign-off Retest the environment after each fix to confirm the path is no longer usable and that alternate routes have not kept the asset exposed.
- Identify exposure choke points Look for controls or weaknesses whose remediation removes multiple routes at once, especially in hybrid environments where one fix can shrink several paths.
Bottom line: Attack-path-led vulnerability management changes the question from what is vulnerable to what is actually reachable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:06 pm
Attack-path-led VM is a governance correction, not a product category tweak. Severity scoring has always struggled to express whether a finding is reachable in the real environment, and that gap becomes more visible as estates span cloud, on-prem and identity-dependent services. The practical implication is that exposure governance must be tied to exploitable paths, not inventories of defects.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between scan-score-patch and attack-path-led VM?
A: Scan-score-patch starts with a list of findings and sorts by severity. Attack-path-led VM starts with the environment, traces how an attacker could move through it, and then prioritises only the weaknesses that change real exposure to critical assets.
👉 Read our full editorial: Attack-path-led vulnerability management is reshaping the VM category