Topic starter
25/10/2026 11:07 am
TL;DR: Vulnerability priorities are shifting from patch counts to exposure-based decisions as AI speeds up flaw discovery, according to JupiterOne. Asset context and exploitability now matter more than raw fix volume for judging risk.
Editorial analysis by NHI Mgmt Group, based on content published by JupiterOne: “Exposure-Based Vulnerability Management: A CISO's Guide”.
By the numbers:
- 52% of organizations rely purely on CVSS ratings to prioritize vulnerabilities rather than real-world exploitability, according to a 2025 Ivanti report cited by JupiterOne.
- Only 39% use simulation technologies like breach and attack simulation to confirm whether a flaw is actually exploitable in their environment, according to a 2025 Ivanti report cited by JupiterOne.
Key questions
Q: Why do patch-count metrics fail to show real vulnerability risk?
A: Patch counts measure throughput, not whether the highest-risk exposures were reduced.
Q: What breaks when vulnerability remediation still relies on severity scores alone?
A: Severity-only triage breaks down when the same flaw appears in different exposure states, because the score cannot tell you which system is public, mission-critical or already exploited.
Q: How should security teams prioritise vulnerabilities when AI speeds up attack discovery?
A: They should prioritise by exploitable context, not by severity alone.
Practitioner guidance
- Shift from patch-count SLAs to exposure windows Set remediation targets by asset criticality, exploitability, and business impact instead of one deadline for every critical CVE.
- Correlate scanners with asset context Join vulnerability findings to ownership, internet exposure, data sensitivity, and connectivity so the program can distinguish noise from real risk.
- Use compensating controls to buy time Apply segmentation, virtual patching, and isolation where a full fix is not yet possible, then revisit the exception on a continuous cadence.
Bottom line: AI-accelerated discovery is exposing the limits of patch-count reporting and pushing teams toward exposure-based prioritisation.
Glossary terms: Exposure-Aware Vulnerability Management, Exposure Window, Compensating Control, Continuous Threat Exposure Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:14 pm
Exposure-based prioritization is now a governance requirement, not a tuning exercise. Once discovery outpaces remediation, patch counts stop describing security posture and start describing operational throughput. The governance question shifts to which exposures can remain open safely, for how long, and under what compensating conditions. That makes vulnerability management a risk allocation problem across security, platform, and product owners, not a queue-management problem inside the security team.
A question worth separating out:
Q: How do exposure-based SLAs differ from traditional patch SLAs?
A: A patch SLA gives every vulnerability above a threshold the same deadline. An exposure-based SLA sets the deadline by the asset’s importance and the vulnerability’s real-world exploitability, so the riskiest combinations get the shortest window.
👉 Read our full editorial: Exposure-based vulnerability management is overtaking patch-count metrics
This post was modified 7 days ago by NHI Mgmt Group