Notifications
Clear all
Topic starter
01/08/2026 8:54 pm
TL;DR: Automated exploit tooling is forcing boards to focus on exposure management because most organisations still prioritise only 48% of exposures by likelihood and business impact, while highly exploitable vulnerabilities take an average of 134 days to remediate, according to Gartner research cited by XM Cyber. The underlying problem is not patch volume, but the time attackers have to move through reachable attack paths before defenders close them.
NHIMG editorial — based on content published by XM Cyber: Exposure management and attack-path prioritisation under autonomous attacker pressure
By the numbers:
- Only 48% of organizations prioritize exposures based on likelihood and business impact, leaving most business-critical assets exposed for a longer duration.
- Most organizations do not use exploitability factors to prioritize remediations, with highly exploitable vulnerabilities taking an average of 134 days to remediate.
- The platform evaluates reachability against live network configurations and compensating controls to determine exploitability, proving that 74% of exposure remediation is wasted on attack path Dead Ends.
Questions worth separating out
Q: What breaks when vulnerability management ignores attack paths?
A: When vulnerability management ignores attack paths, teams end up fixing issues that are technically severe but operationally irrelevant while leaving reachable exposures open.
Q: Why do exposed credentials and over-permissioned identities make remediation harder?
A: Exposed credentials and over-permissioned identities reduce the margin for error because they turn ordinary weaknesses into usable breach routes.
Q: What should teams measure to know whether exposure management is working?
A: Track time to containment, secret revocation latency, and the percentage of high-risk systems covered by explicit ownership.
Practitioner guidance
- Implement exposure prioritisation by reachability Rank remediation based on whether an issue sits on a live path to Tier 0 or other mission-critical assets, not just on severity scores or ticket age.
- Fold identity findings into exposure workflows Treat exposed secrets, standing privilege, service-account over-permissioning, and directory misconfigurations as first-class exposure inputs in the same queue as CVEs.
- Set exploitability-based remediation SLAs Assign shorter SLAs to findings that are public, reachable, or paired with weak identity controls.
What's in the full article
XM Cyber's full article covers the operational detail this post intentionally leaves for the source:
- Gartner citation context and the board-level framing around autonomous attackers and generative AI misuse
- XM Cyber's attack-graph explanation of how reachability and compensating controls separate dead ends from viable paths
- The report's discussion of continuous exposure management, including how it validates exploitability in live environments
- Additional detail on how strategic choke points can reduce remediation work while closing paths to mission-critical assets
👉 Read XM Cyber's analysis of exposure management and attack-path prioritisation →
Exposure management and attack-path prioritisation: are your controls keeping up?
Explore further
01/08/2026 9:03 pm
Static vulnerability management is the wrong mental model for machine-speed threats. The article shows that severity scoring without environment context leads to long remediation queues and weak decision-making. That is not just an operational problem, it is a governance failure because risk is being measured in counts, not in reachable exposure. For identity programmes, the same flaw appears when standing privilege and exposed secrets are treated as separate hygiene issues instead of one attack path. Practitioners should treat exploitability as a governance input, not a post-remediation metric.
A question worth separating out:
Q: Should organisations prioritise exploitability over severity scores?
A: Yes, when the goal is to reduce real-world risk rather than to manage a report. Severity scores remain useful, but exploitability and business context determine whether a flaw is urgent. Organisations should prioritise based on what is reachable, what is exposed, and what can lead to crown-jewel assets before remediation completes.
👉 Read our full editorial: Exposure management is failing faster than automated attackers can exploit it
