Topic starter
13/10/2026 1:21 pm
TL;DR: Exploitability alone does not resolve triage because the same finding can carry very different impact depending on workload sensitivity, trust boundaries and business reliance, according to Nullify. Security teams still need context-rich scoring that reflects how their own environment is structured and used.
Editorial analysis by NHI Mgmt Group, based on content published by Nullify: “Exploitability Is Only Half the Triage Decision”.
Key questions
Q: How should security teams combine exploitability with business context in triage?
A: Use exploitability to determine whether a vulnerability is technically usable, then apply a separate impact layer that reflects workload sensitivity, trust boundaries, data exposure and business dependency.
Q: Why do vulnerable findings still need manual rescoring in many programmes?
A: Manual rescoring persists when automated tools lack the context humans use to judge impact, such as architecture, sensitive data handling and control coverage.
Q: What signals show that triage automation is missing the right context?
A: The clearest signals are repeated overrides, inconsistent rankings between teams, and findings that look severe on paper but never move because they are low value in practice.
Practitioner guidance
- Define context inputs for triage scoring Map the minimum environment signals a triage system needs, including workload sensitivity, trust boundary location, business dependency and control coverage.
- Separate exploitability from business impact Keep technical exploitability as one dimension and introduce a second, governed impact layer that reflects your own architecture and risk appetite.
- Establish a rescoring feedback loop Track where security engineers override or rescore automated priorities, then feed those decisions back into the model or policy layer.
Bottom line: Exploitability is necessary for triage, but it is not sufficient because impact depends on workload context, data sensitivity and trust boundaries.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/10/2026 1:22 pm
Context, not exploitability, is the decisive variable in modern triage. Vulnerability management fails when teams treat technical exploitability as a universal ranking signal. The same flaw can represent radically different exposure depending on trust boundaries, data sensitivity and workload criticality. Practitioners should treat prioritisation as a governed decision process, not a scanner output.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How can AI-assisted vulnerability triage be governed without losing human judgment?
A: Keep humans accountable for policy, exceptions and risk appetite, but let automation ingest authoritative environment context and apply it consistently. The goal is not to remove judgment; it is to standardise the background information the team uses when making it. Governance should focus on input quality, provenance and override discipline.
👉 Read our full editorial: Exploitability scores need environment context to drive triage