Topic starter
01/08/2026 10:48 pm
TL;DR: Exposure scores often mislead security teams when asset context, configuration changes, and remediation priorities are treated as static, according to Hadrian. The real issue is not the score itself, but the governance gap between discovery, context, and action, especially where identity and access paths shape exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Hadrian: “Security teams know the scores are wrong.”.
Key questions
Q: What breaks when exposure findings are routed without asset value context?
A: Teams lose the ability to distinguish strategic risk from routine noise.
Q: Why do identity and access paths change exposure management outcomes?
A: Because exposure is not only about whether an asset exists, but about who can reach it and through what authority.
Q: How do security teams know if an exposure programme is actually working?
A: Look for fewer verified attack paths, not just fewer alerts.
Practitioner guidance
- Tighten asset-to-change correlation Link exposure scoring to configuration events, asset movement, and ownership changes so scores update when the environment changes.
- Add identity context to prioritisation Weight remediation queues by who can reach the asset, what privilege is involved, and whether access depends on standing credentials or delegated trust.
- Separate scoring from decision making Use exposure scores as an input, then apply business criticality, reachability, and control coverage before assigning remediation priority.
Bottom line: Attack surface scores can mislead when they are detached from live asset state and access context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:56 pm
Exposure scores fail when they are treated as governance outputs rather than risk inputs. A score is only as current as the asset, identity, and configuration data behind it. When teams use it as a fixed verdict, they create false confidence and delay the more important question of whether access paths have changed.
A question worth separating out:
Q: Should teams use attack surface scores as the basis for remediation ownership?
A: No, ownership should come from the team that controls the asset and the access path, while the score informs urgency. If scoring is used to assign ownership, accountability becomes abstract and fixes stall. The better model keeps operational ownership separate from risk ranking.
👉 Read our full editorial: Attack surface scores are wrong: what exposure teams need to fix