Topic starter
01/08/2026 8:54 pm
TL;DR: Automated exploit tooling is forcing boards to focus on exposure management because most organisations still prioritise only 48% of exposures by likelihood and business impact, while highly exploitable vulnerabilities take an average of 134 days to remediate, according to Gartner research cited by XM Cyber. The underlying problem is not patch volume, but the time attackers have to move through reachable attack paths before defenders close them.
Editorial analysis by NHI Mgmt Group, based on content published by XM Cyber: “Capitalize on Mythos Hype to Fix Your Exposure and Vulnerability Management”.
By the numbers:
- Only 48% of organizations prioritize exposures based on likelihood and business impact.
- Highly exploitable vulnerabilities take an average of 134 days to remediate.
- At more than 50 days, the mean time to remediate vulnerabilities remains much higher than the time it would take attackers to exploit using automation.
Key questions
Q: What breaks when exposure management is not tied to attack paths?
A: Teams end up fixing the loudest findings instead of the most exploitable ones.
Q: Why do some known vulnerabilities keep getting exploited even when patches exist?
A: Known vulnerabilities keep getting exploited because patching is often slower than attacker activity, and organizations rarely fix everything at once.
Q: How do security teams know if an exposure programme is actually working?
A: Look for fewer verified attack paths, not just fewer alerts.
Practitioner guidance
- Map remediation to reachable attack paths Rank exposures by whether they can actually be reached from real network and identity conditions, then escalate the ones that lead to crown-jewel assets.
- Deprioritise dead-end findings Separate isolated vulnerabilities from exposures that sit on end-to-end paths, so engineering effort goes to issues that can change adversary outcomes.
- Merge identity and exposure telemetry Correlate over-permissions, exposed credentials, and misconfigurations in one view so the team can see privilege escalation routes early.
Bottom line: Exposure management fails when teams prioritise vulnerability lists without testing whether an attacker can actually reach a critical asset.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:03 pm
Exposure management is now an identity governance problem as much as a vulnerability problem. The article shows that reachable exposure often depends on exposed credentials, over-permissions, and misconfigured identity paths rather than code defects alone. That means IAM and NHI teams cannot treat identity and vulnerability programmes as separate queues. Practitioners should manage exposure as a path-to-privilege problem, not a patch list.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: No. The article shows that exposed credentials, directory misconfigurations, and reachable flaws combine into usable attack paths, so separating them hides the real risk. IAM, NHI, and vulnerability teams need one prioritisation model that reflects exploitability and path reachability.
👉 Read our full editorial: Exposure management is failing faster than automated attackers can exploit it