Notifications
Clear all
Topic starter
02/08/2026 11:30 am
TL;DR: Security teams are drowning in disclosures and exploit chatter while only a small share of vulnerabilities are ever weaponized, leaving exploitable exposure unresolved until attackers move first, according to Horizons.ai. The real problem is not visibility but proving what is reachable, exploitable, and worth fixing before response workflows collapse under noise.
NHIMG editorial — based on content published by Horizons.ai: The Exploit Window Is Shrinking. Most Security Workflows Are Not
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when security teams rely on vulnerability severity instead of exploitability?
A: Prioritisation breaks first.
Q: Why do exposed credentials make exploitability a broader governance problem?
A: Because exposed credentials can turn a theoretical software flaw into a live access path.
Q: How do security teams know whether exploitability management is working?
A: Teams should look for fewer high-priority findings tied to reachable assets, shorter response times for KEV-listed issues, and a measurable drop in lateral movement paths toward clinical systems.
Practitioner guidance
- Prioritise reachable exposure over severity queues Sort new findings by whether the vulnerable asset is internet-facing, actually deployed, and reachable in the current environment before assigning remediation priority.
- Add validation before escalation Require a repeatable exploitability check before opening executive escalations, so teams can distinguish headline risk from operationally usable risk.
- Tie remediation to proof of risk reduction Capture before-and-after validation results for each high-priority issue so leadership can see whether the fix changed attacker reachability.
What's in the full article
Horizons.ai's full blog covers the operational detail this post intentionally leaves for the source:
- The Rapid Response workflow for validating exploitability in production environments.
- Guidance on how the vendor classifies emerging vulnerabilities by attacker interest, deployment prevalence, and accessibility.
- Examples of targeted validation tests developed with human analysis and AI-assisted research.
- The product workflow for tracking progress from discovery to resolution.
👉 Read Horizons.ai's analysis of exploitability-driven vulnerability response →
Exploitability is the new bottleneck in vulnerability triage?
Explore further
02/08/2026 12:45 pm
Exploitability is now the governance unit that matters most. Security teams have spent years improving visibility, but visibility alone does not tell you whether an attacker can actually get in. The article reflects a broader industry shift from inventory-centric triage to reachability-centric decision-making. For IAM and NHI programmes, the same logic applies to standing access, exposed secrets, and service accounts: if an identity can be used in a live attack path, it is already a governance failure, not a theoretical issue.
A question worth separating out:
Q: Which frameworks align with exploitability-driven remediation?
A: NIST CSF and NIST SP 800-53 both support the control discipline behind exposure validation, while MITRE ATT&CK helps teams map how an exposed weakness becomes a real attack path. For identity-heavy exposure, the NHI Lifecycle Management Guide is the better lens for rotation, offboarding, and reachability.
👉 Read our full editorial: Exploitability is the new bottleneck in vulnerability response
