Topic starter
02/08/2026 12:27 pm
TL;DR: EPSS alone is not enough for modern exposure management, because validation has to prove whether a finding is exploitable in context rather than only whether it looks risky, according to Hadrian. That shifts CTEM from score-driven prioritisation toward adversary-informed decision-making.
Editorial analysis by NHI Mgmt Group, based on content published by Hadrian: “Beyond EPSS: The need to redefine Validation in CTEM”.
Key questions
Q: How do security teams know if CTEM validation is working?
A: Validation is working when the remediation queue gets smaller, false criticals drop, and engineering attention shifts to confirmed attack paths rather than scan output.
Q: Why is EPSS alone not enough for exposure prioritisation?
A: EPSS is a probability signal, not proof of exploitability.
Q: What are the signs that an exposure management program is relying too much on scores?
A: A score-heavy programme usually remediates many low-value findings while still leaving validated attack paths unresolved.
Practitioner guidance
- Define validation criteria for every high-priority exposure Require a clear test for reachability, exploit path, and likely impact before a finding enters the remediation queue.
- Separate scoring from decision-making Use EPSS and similar scores to triage scale, but require contextual validation before escalating issues to operational teams or executives.
- Tie findings to identity and access context Document which authentication flows, privileges, and trust boundaries make a finding exploitable.
Bottom line: EPSS helps rank exposure, but it cannot prove whether a finding is usable in context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:25 pm
Validation is becoming the decisive control layer in CTEM. Exposure programmes that stop at scoring confuse probability with exploitability, which creates brittle prioritisation. The security team ends up treating every high score as urgent and every lower score as ignorable, even when the opposite may be true in context. That makes validation the mechanism that turns exposure data into defensible action.
A question worth separating out:
Q: Should CTEM teams prioritise validation before remediation or after triage?
A: Validation should happen after initial triage but before the remediation queue is finalised. That sequence preserves speed while preventing teams from treating unproven issues as confirmed risk. In practice, the best programmes use scoring to narrow the field and validation to decide what actually gets fixed first.
👉 Read our full editorial: Beyond EPSS: Why validation is redefining CTEM programs