Exploitability is the new bottleneck in vulnerability triage

TL;DR: Security teams are drowning in disclosures and exploit chatter while only a small share of vulnerabilities are ever weaponized, leaving exploitable exposure unresolved until attackers move first, according to Horizons.ai. The real problem is not visibility but proving what is reachable, exploitable, and worth fixing before response workflows collapse under noise.

Editorial analysis by NHI Mgmt Group, based on content published by Horizons.ai: “The Exploit Window Is Shrinking. Most Security Workflows Are Not.”.

Key questions

Q: What breaks when vulnerability remediation still relies on severity scores alone?

A: Severity-only triage breaks down when the same flaw appears in different exposure states, because the score cannot tell you which system is public, mission-critical or already exploited.

Q: Why does exploitability testing matter more when remediation is slow?

A: Exploitability testing matters more because the value of a finding depends on how quickly attackers can use it.

Q: What are the signs that vulnerability triage is becoming a security bottleneck?

A: Common signs include engineers spending most of their week validating noisy submissions, a backlog of unreviewed reports, frequent duplicate closures, and slow handling of truly critical findings.

Practitioner guidance

• Validate attacker reachability before assigning remediation priority Use exposure testing and environment context to determine whether a disclosed vulnerability is actually reachable from the attacker’s likely path, then route only confirmed risks into urgent remediation.
• Separate exploitability from severity scoring Treat CVSS and vendor advisories as inputs, not decisions, and add a validation step that confirms whether the issue can be operationalised in your environment before escalating it.
• Measure mitigation by proof, not by ticket closure Require evidence that the fix removed attacker-relevant exposure, such as repeatable validation results or blocked execution paths, before marking the issue as resolved.

Bottom line: Exploitability is the bottleneck because teams can see many vulnerabilities but still cannot prove which ones are reachable in their environment.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →