Notifications
Clear all
Topic starter
01/08/2026 10:47 pm
TL;DR: Verizon’s 2026 DBIR says exploited vulnerabilities rose to 31% of breaches, third-party involvement reached 48%, and only 26% of critical KEVs were fully remediated in 2025, with median resolution at 43 days. The gap is not discovery, but coordinated remediation across assets, owners, and identity-linked exposure paths.
NHIMG editorial — based on content published by Tonic: Why vulnerability management has become a math problem security teams can’t solve
By the numbers:
- Exploitation of vulnerabilities is now the top initial access vector for breaches, rising to 31% of the entire DBIR dataset.
- The DBIR says third-party involvement in breaches jumped 60% from last year’s dataset, reaching 48% of total breaches.
Questions worth separating out
Q: What breaks when vulnerability management is limited to scan results?
A: Teams end up triaging large numbers of findings without knowing which ones can be chained into a working attack.
Q: Why do third-party connections make cybercrime harder to contain?
A: Third-party connections extend trust beyond the organisation’s direct control, which gives attackers more routes to reuse stolen credentials or approved access.
Q: How should teams prove that remediation actually reduced risk?
A: They should re-run the exposure test after the fix or mitigation, then compare the pre-change and post-change results for reachability, blocking, and alerting.
Practitioner guidance
- Map vulnerabilities to access paths Link each critical vulnerability to the service accounts, API keys, OAuth grants, and admin roles that make it exploitable, then prioritise fixes where those identities can reach production or sensitive data.
- Shorten remediation by asset ownership Require every high-risk finding to have a named business owner, technical owner, and due date before it enters the backlog, so security is not waiting on an ambiguous handoff.
- Review third-party identities as part of vuln response When a vulnerability involves a vendor, contractor, or SaaS integration, reassess the connected credentials and revoke standing access that is not strictly required for the business process.
What's in the full article
Tonic's full article covers the operational detail this post intentionally leaves for the source:
- How the Unified Exposure Management workflow links vulnerabilities to business context and ownership
- The platform’s approach to correlating alerts, assets, and exposures into a remediation queue
- Examples of how agentic AI is used to reason across fragmented security and business data
- Why the article argues for machine-speed remediation rather than manual handoffs
👉 Read Tonic’s analysis of why vulnerability management has become a remediation race →
Exploited vulnerabilities, third parties, and identity gaps: what now?
Explore further
01/08/2026 10:55 pm
Exploitability has become the governing metric, not vulnerability volume: the article shows why counting findings is no longer enough when attackers move faster than remediation queues. The real question is which exposed asset can be reached first, which identity can be abused next, and which business process depends on the path. That is a NIST CSF and MITRE ATT&CK problem as much as a scanning problem. Practitioners should treat exploitability, ownership, and access path as the primary prioritisation logic.
A question worth separating out:
Q: Who should own vulnerability fixes that involve credentials or integrations?
A: Ownership should sit with the team that controls the affected asset and the connected identity path, not only the team that found the issue. When credentials, integrations, or administrative roles are involved, IAM, platform, and application owners must coordinate because the breach path crosses multiple control domains.
👉 Read our full editorial: Why vulnerability management is now a remediation race
