Notifications
Clear all
Topic starter
02/08/2026 12:12 pm
TL;DR: Cisco’s end-of-life for Kenna underscores a broader shift: security teams now face cloud misconfigurations, identity exposures, vendor risk, and app vulnerabilities in one expanding attack surface, according to Nucleus. The decisive challenge is no longer counting issues but operationalising continuous prioritisation and remediation across the full exposure graph.
NHIMG editorial — based on content published by Nucleus: Cisco’s end-of-life for Kenna and the rise of exposure management
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
Questions worth separating out
Q: What fails when teams rank exposure only by vulnerability severity?
A: Severity-only ranking misses whether a weakness is actually reachable through identity, configuration, or external access.
Q: Why do identity weaknesses change vulnerability management outcomes?
A: Identity weaknesses change outcomes because attackers rarely need a perfect exploit if they can combine a modest flaw with privilege, delegation, or exposed credentials.
Q: What do security teams get wrong about exposure management?
A: They often treat it as a reporting layer above vulnerability management instead of a system that changes remediation decisions.
Practitioner guidance
- Map identity context into exposure prioritisation Feed privileged accounts, service accounts, and OAuth grants into remediation scoring so that reachability reflects permissions as well as technical severity.
- Separate counts from risk-bearing exposures Replace backlog reports that only list vulnerabilities with exposure views that correlate asset criticality, exploitability, identity permissions, and external reachability.
- Operationalise closed-loop remediation ownership Assign fixes to security, IT, cloud, or DevOps owners inside a workflow that tracks verification, not just ticket creation.
What's in the full article
Nucleus's full article covers the operational detail this post intentionally leaves for the source:
- How the vendor frames exposure management as an operating model rather than a reporting layer
- Implementation detail on unifying vulnerability, identity, and configuration signals into one workflow
- Practical examples of closed-loop remediation and ownership handoffs across security and IT
- The vendor’s view of how Kenna’s end-of-life shapes the migration path to exposure management
👉 Read Nucleus's perspective on why exposure management replaces vulnerability management →
Exposure management vs vulnerability management: what teams need now?
Explore further
02/08/2026 1:15 pm
Exposure management is now an identity problem as much as a vulnerability problem. Once attackers can use credentials, tokens, OAuth grants, and over-privileged service accounts to turn technical weaknesses into reachable paths, identity becomes part of exposure math. That changes the operating model for IAM and PAM teams, which can no longer sit outside vulnerability prioritisation. The field should treat identity context as a core input to remediation decisions, not a downstream control report.
A question worth separating out:
Q: How should organisations connect remediation with identity governance?
A: They should make identity remediation part of the exposure workflow, not an afterthought. That means privilege reduction, secret rotation, access review, and offboarding checks must be linked to the same remediation queue that handles technical vulnerabilities. When access is the path to impact, governance and remediation need a shared operating model.
👉 Read our full editorial: Exposure management replaces vulnerability management as the strategic model
