Topic starter
01/08/2026 10:47 pm
TL;DR: CVE counts and CVSS scores can make vulnerability programs look effective while leaving real attack paths untouched, because severity scoring does not measure reachability, exploitability, or access to critical assets, according to XM Cyber. Continuous Exposure Management shifts the metric from how many findings are closed to how many viable paths to crown-jewel systems remain.
Editorial analysis by NHI Mgmt Group, based on content published by XM Cyber: “Your CVE Count Is a Meaningless Metric”.
Key questions
Q: What breaks when vulnerability programmes only measure exposure counts?
A: They lose the ability to distinguish theoretical weaknesses from issues an attacker can actually exploit.
Q: Why do CVSS-based remediation policies often miss the real business risk?
A: Because CVSS rates the flaw in isolation, not the environment around it.
Q: What are the signs that healthcare exposure management is failing in practice?
A: Common signs include repeated false positives, slow patch decisions, poor visibility into hybrid assets, and continued exposure on critical systems despite scanning.
Practitioner guidance
- Prioritise validated attack paths Rank remediation by whether an issue sits on a live path to critical assets, not by CVSS alone.
- Map identity exposure into vulnerability triage Add over-permissioned accounts, cached credentials, and delegated access to the same triage view as software flaws so the queue reflects real compromise routes.
- Replace score-only SLAs with exposure SLAs Set remediation targets around closed attack paths and measured blast-radius reduction, then report progress as a change in reachable routes rather than a count of tickets closed.
Bottom line: CVE and CVSS reporting can look healthy while direct attack paths remain open to critical assets.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:55 pm
Attack-path risk is the better governance unit than CVE count. CVE volume tells teams how many flaws they can see, but not whether those flaws sit on a viable route to critical assets. Security programmes that optimise for closure rate can still leave direct compromise paths untouched. The practical conclusion is that remediation governance has to shift from inventory management to exposure reduction.
A question worth separating out:
Q: How do security teams measure whether remediation is actually reducing policy risk?
A: Teams should measure whether the share of records at risk is falling over time, not just whether tickets are closing. Useful signals include the percentage of risk removed from top datastores or objects, the remaining exposure after fixes, and whether the policy trend is moving downward. If those numbers do not improve, remediation is not changing the risk picture.
👉 Read our full editorial: CVE counts miss exposure: why attack-path risk matters more