Topic starter
02/08/2026 12:12 pm
TL;DR: Cisco’s end-of-life for Kenna underscores a broader shift: security teams now face cloud misconfigurations, identity exposures, vendor risk, and app vulnerabilities in one expanding attack surface, according to Nucleus. The decisive challenge is no longer counting issues but operationalising continuous prioritisation and remediation across the full exposure graph.
Editorial analysis by NHI Mgmt Group, based on content published by Nucleus: “Kenna Lit the Spark on the Exposure Management Fire and It’s Time for the Next Generation”.
Key questions
Q: Which frameworks help teams move from vulnerability management to exposure management?
A: NIST CSF and NIST SP 800-53 help structure governance, while EPSS and CISA KEV inform exploitability.
Q: Why do identity issues often change exposure prioritisation?
A: Identity issues matter because many attack paths depend on credentials, privilege, delegation, and trust relationships rather than a single technical flaw.
Q: What breaks when teams rely on scanner output alone?
A: Scanner-only programmes drown teams in duplicate, low-context alerts and push attention toward technical severity instead of exploitability.
Practitioner guidance
- Prioritise exposures by reachable attack path Score issues using exploitability, internet exposure, identity reachability, and business context instead of severity alone.
- Integrate identity signals into exposure workflows Feed privileged accounts, service identities, tokens, and access paths into the same queue that handles infrastructure and application risk.
- Replace backlog metrics with closure metrics Track time from discovery to verified remediation so leadership can see whether prioritisation is actually reducing risk.
Bottom line: Exposure management is replacing vulnerability management because modern attack surfaces now include identities, misconfigurations, dependencies, and vendor risk, not just CVEs.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:15 pm
Exposure management is now the more accurate governance model for modern attack surface risk. Vulnerability management remains necessary, but it is no longer sufficient when cloud misconfigurations, identities, and vendor dependencies can matter more than raw CVSS volume. The strategic question has shifted from how many issues exist to which exposures can actually be reached and chained. Practitioners should treat exposure management as the control plane for prioritisation, not as a reporting layer.
A question worth separating out:
Q: Why do stripped audit-log fields create so much risk for IAM and cloud security teams?
A: Because the field often carries the only unambiguous proof of what changed. If policyDelta is removed, a SetIamPolicy event can no longer be reliably interpreted as logging removal, a role grant, or a harmless update. That turns precise detections into guesses and makes silent coverage loss much more likely.
👉 Read our full editorial: Exposure management replaces vulnerability management as the strategic model