Notifications
Clear all
Topic starter
01/08/2026 8:58 pm
TL;DR: Security teams already see more findings than they can fix, but that does not answer whether they are actually harder to attack, according to Horizons.ai. The shift from vulnerability management to exposure management reflects a more accurate risk model because attackers chain weaknesses, identities, permissions, and trust relationships rather than treating issues in isolation.
NHIMG editorial — based on content published by Horizons.ai: Why Exposure Management Is Replacing Vulnerability Management
Questions worth separating out
A: Start with technical severity, then re-rank issues that sit on privileged accounts, externally reachable apps, or business-critical workflows.
Q: Why do identity and permission relationships change vulnerability risk?
A: Because attackers use identities and permissions to turn a technical flaw into movement.
Q: What do teams get wrong when they use severity as the main priority signal?
A: They confuse the characteristics of a finding with the opportunity it creates for an attacker.
Practitioner guidance
- Map vulnerabilities to reachable attack paths Use asset, identity, and privilege data together so each high-priority finding is tied to a real path to sensitive systems or data.
- Review identity relationships alongside patch queues Check whether weak systems are connected to service accounts, third-party access, or over-permissioned roles that turn a defect into exposure.
- Prioritise control changes that shrink blast radius Re-segment access, reduce standing privileges, and remove unnecessary trust links where attack paths converge.
What's in the full article
Horizons.ai's full analysis covers the operational detail this post intentionally leaves for the source:
- How the CTEM framework is being operationalised across vulnerability, exposure, and remediation workflows.
- Practical guidance for building attack-path prioritisation into security operations reporting.
- The vendor's examples of how identity and permission relationships alter what should be fixed first.
- A closer look at how teams can translate exposure findings into measurable risk reduction.
👉 Read Horizons.ai's analysis of why exposure management is replacing vulnerability management →
Exposure management versus vulnerability management: what teams miss?
Explore further
01/08/2026 9:05 pm
Exposure management is now an identity problem as much as a vulnerability problem. The article's core argument is correct because attackers rarely exploit a single flaw in isolation. They exploit the relationship between a technical weakness and the identities, permissions, and trust links that let them turn that weakness into reach. In practice, that means IAM and NHI governance are part of exposure reduction, not separate disciplines.
A question worth separating out:
Q: What should teams measure to know whether exposure management is working?
A: Track time to containment, secret revocation latency, and the percentage of high-risk systems covered by explicit ownership. If findings regularly sit between discovery and action, the programme is failing where AI-driven testing will pressure it most. Those metrics show whether the organisation can respond at machine speed.
👉 Read our full editorial: Exposure management is replacing vulnerability management in practice
