Notifications
Clear all
Topic starter
02/08/2026 12:27 pm
TL;DR: EPSS alone is not enough for modern exposure management, because validation has to prove whether a finding is exploitable in context rather than only whether it looks risky, according to Hadrian. That shifts CTEM from score-driven prioritisation toward adversary-informed decision-making.
NHIMG editorial — based on content published by Hadrian: Beyond EPSS, redefining validation in CTEM
Questions worth separating out
Q: How should security teams validate exposures before they go into remediation queues?
A: Security teams should require proof that an exposure is exploitable in their own environment, not just that it scores highly or appears in threat intelligence.
Q: Why do vulnerability scores often mislead CTEM programs?
A: Vulnerability scores are usually environment-agnostic, so they cannot account for whether a system is internet-facing, isolated, or protected by strong identity controls.
Q: What breaks when exposure validation is not part of the prioritisation process?
A: Without validation, teams keep funding remediation based on theoretical risk instead of confirmed exposure.
Practitioner guidance
- Build validation into CTEM triage Require each high-priority exposure to pass a reachability and exploitability check before it enters remediation queues.
- Add identity context to exposure scoring Enrich exposure records with privilege scope, authentication method, and credential lifetime so that service accounts, API keys, and other secrets can be evaluated in context, not isolation.
- Separate signal from noise in remediation Create a rule that scores alone never trigger SLA assignment.
What's in the full report
Hadrian's full research covers the operational detail this post intentionally leaves for the source:
- Asset-by-asset validation logic that distinguishes reachable exposure from theoretical weakness
- Practical prioritisation criteria for turning exposure findings into remediation queues
- Operational examples of how validation supports CTEM workflows in real environments
- The source's framing of how offensive testing and exposure management intersect
👉 Read Hadrian's research on why validation is redefining CTEM →
Beyond EPSS in CTEM: what validation changes for security teams?
Explore further
02/08/2026 1:25 pm
Validation is now the deciding layer in exposure management. CTEM programs fail when they confuse risk scoring with attack reality. EPSS can inform prioritisation, but only validation tells teams whether a weakness is reachable, chainable, and worth acting on first. For identity-led environments, that means asset exposure cannot be judged without access scope and privilege context. The practitioner conclusion is straightforward: score less, prove more.
A question worth separating out:
Q: How do identity and secret controls change exposure management decisions?
A: Identity and secret controls determine whether a vulnerability is merely present or actually exploitable. Short-lived credentials, tight privilege boundaries, and strong rotation reduce the chance that a finding becomes an attack path. Over-privileged accounts and persistent secrets do the opposite, so exposure programmes should factor them into every priority decision.
👉 Read our full editorial: Beyond EPSS: Why validation is redefining CTEM programs
