Notifications
Clear all
Topic starter
01/08/2026 8:59 pm
TL;DR: Attack-path-led vulnerability management is replacing scan-score-patch thinking with continuous exposure discovery, validation, prioritisation, and remediation because only 26% of KEV vulnerabilities were fully remediated and remediation timelines have reached 43 days, according to XM Cyber and the 2026 Verizon DBIR. The category is shifting toward proving whether a path to critical assets actually exists, not whether a vulnerability is merely present.
NHIMG editorial — based on content published by XM Cyber: attack-path-led vulnerability management and the SC Awards Europe category shift
By the numbers:
- Only 26% of KEV vulnerabilities were ever fully remediated.
- Remediation timelines have grown to 43 days.
- 74% of exposures are on dead ends that can’t reach critical assets.
Questions worth separating out
Q: How should security teams prioritise vulnerabilities in hybrid environments?
A: Prioritise by whether a vulnerability is on a live path to a critical asset, not by severity alone.
Q: Why do scan-driven vulnerability programmes often miss the real risk?
A: They treat vulnerabilities as isolated items instead of as links in an attacker’s route.
Q: What breaks when remediation is measured only by ticket closure?
A: Teams lose proof that the exposure actually disappeared.
Practitioner guidance
- Prioritise remediation by reachable attack path Rank findings by whether they lead to critical assets, then retire items that do not alter attacker reach.
- Identify chokepoints across identity and infrastructure Map which vulnerabilities, accounts, or misconfigurations sit on multiple routes, then fix those first because they collapse more than one path.
- Validate closure after every remediation Retest the path after the fix to prove the route is gone, not just logged as resolved.
What's in the full article
XM Cyber's full blog covers the operational detail this post intentionally leaves for the source:
- Attack-graph analysis examples showing how paths are mapped across hybrid environments.
- The judge commentary and ROI evidence behind the SC Awards recognition.
- XM Cyber's explanation of choke points and why one fix can collapse multiple routes.
- Planned visibility and remediation integrations for teams operating at implementation stage.
👉 Read XM Cyber's analysis of attack-path-led vulnerability management →
Attack-path-led VM: what it means for exposure teams now?
Explore further
01/08/2026 9:06 pm
Attack-path-led exposure management is becoming the right unit of security work. Scan-driven vulnerability management measures defect volume, but attackers operate along routes to assets. That means programme value increasingly depends on whether teams can model reachability, privilege dependency, and control chokepoints across hybrid environments. The category is moving toward exposure management because risk is now defined by exploitability in context, not by the mere existence of a CVE.
A question worth separating out:
Q: Who should be accountable for attack-path-led remediation?
A: Security, infrastructure, identity, and application owners all share accountability because the path often crosses their boundaries. The governance failure is assuming vulnerability management is a single-team function. A workable model assigns ownership by path segment, defines remediation SLAs by asset criticality, and requires evidence that the route to the target has been closed.
👉 Read our full editorial: Attack-path-led vulnerability management is reshaping the VM category
