Exposure-based vulnerability management: what changes for security teams?

TL;DR: AI-accelerated flaw discovery is making patch-count metrics unreliable, according to JupiterOne, because testing and change-management capacity cannot keep up with the volume of urgent fixes. Exposure-based prioritization instead weighs asset criticality, real-world exploitability, and compensating controls, and that is now the more defensible way to judge whether an environment is actually safer.

Editorial analysis by NHI Mgmt Group, based on content published by JupiterOne: “Exposure-Based Vulnerability Management: A CISO's Guide”.

By the numbers:

• 52% of organizations rely purely on CVSS ratings to prioritize vulnerabilities rather than real-world exploitability, according to a 2025 Ivanti report cited by JupiterOne.
• Only 39% use simulation technologies like breach and attack simulation to confirm whether a flaw is actually exploitable in their environment, according to a 2025 Ivanti report cited by JupiterOne.

Key questions

Q: How should security teams prioritise vulnerabilities when AI speeds up attack discovery?

A: They should prioritise by exploitable context, not by severity alone.

Q: Why do patch-count metrics fail to show real vulnerability risk?

A: Patch counts measure throughput, not whether the highest-risk exposures were reduced.

Q: What breaks when vulnerability remediation still relies on severity scores alone?

A: Severity-only triage breaks down when the same flaw appears in different exposure states, because the score cannot tell you which system is public, mission-critical or already exploited.

Practitioner guidance

• Shift from patch-count SLAs to exposure windows Set remediation targets by asset criticality, exploitability, and business impact instead of one deadline for every critical CVE.
• Correlate scanners with asset context Join vulnerability findings to ownership, internet exposure, data sensitivity, and connectivity so the program can distinguish noise from real risk.
• Use compensating controls to buy time Apply segmentation, virtual patching, and isolation where a full fix is not yet possible, then revisit the exception on a continuous cadence.

Bottom line: AI-accelerated discovery is exposing the limits of patch-count reporting and pushing teams toward exposure-based prioritisation.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →