Topic starter
11/11/2026 6:05 pm
TL;DR: What defenders can actually see, rather than what exists, is the gap exposed by a new PHP2Shell-style flaw, according to WithSecure. Exposure management shifts the response from manual triage to continuous prioritisation across assets, cloud services and digital identities.
Editorial analysis by NHI Mgmt Group, based on content published by WithSecure: “From panic to plan: exposure management for the next PHP”.
Key questions
Q: Why do exploitable CVEs need more than CVSS scoring?
A: CVSS describes potential severity, not whether the issue is present in a live execution path or likely to be abused in your environment.
Q: How does continuous asset discovery support identity governance?
A: Continuous asset discovery supports identity governance by keeping the inventory of accounts, entitlements and infrastructure current, including machine identities, service accounts and cloud services.
Q: How do exposure management programs identify what is affected first?
A: Exposure management programmes identify what is affected first by continuously discovering assets, mapping them to internet exposure, software version, known vulnerabilities and criticality.
Practitioner guidance
- Build a continuous asset and identity inventory Track on-premise systems, cloud services and digital identities in one exposure model so a new advisory can be assessed against real scope instead of assumptions.
- Score remediation by exploitability and impact Weight internet exposure, attacker interest and business criticality above raw severity so the queue reflects likely harm, not just CVSS.
- Standardise partner-level exposure reports Create a repeatable reporting view that can be shared across partners without rebuilding the assessment each time a new issue appears.
Bottom line: The core problem is not the lack of alerts, but the lack of a reliable, shared view of what is exposed when a new flaw appears.
Glossary terms: Exposure management, Attack Surface Management, Continuous Automated Red Teaming, Cloud Services
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Exposure management becomes a decision system, not a dashboard. The practical value is not volume of telemetry but faster decisions about what is exposed, what is affected and what must go first. That shifts the programme from passive visibility to operational triage, which is where response time is won or lost. Practitioners should treat exposure data as a prioritisation engine, not as a reporting layer.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the best way to prioritise remediation after a major advisory?
A: The best way to prioritise remediation after a major advisory is to rank affected systems by exploitability, exposure and business criticality, then fix the combinations that are both easy to attack and tied to sensitive business function. Internet-facing assets, privileged systems and shared services should move first, especially where no compensating control exists.
👉 Read our full editorial: Exposure management makes PHP2Shell-style flaws easier to prioritize