Topic starter
01/08/2026 9:00 pm
TL;DR: AI has shortened the gap between vulnerability disclosure and weaponization, while many teams still run scan, score, ticket, chase workflows that assume defenders have time, according to Tonic. The real control problem is not finding more issues, but contextualizing business impact, ownership, and exploitability quickly enough to reduce exposure before attackers do.
Editorial analysis by NHI Mgmt Group, based on content published by Tonic: “Vulnerability Management is Too Slow for the Mythos Era”.
Key questions
Q: What breaks when vulnerability management stops at scanning and ticketing?
A: Teams create a false sense of progress.
Q: Why does prioritizing vulnerabilities by business context improve remediation outcomes?
A: Prioritizing by business context reduces wasted effort on low-value findings and directs scarce resources toward exposures that could disrupt important services.
Q: What are the signs that vulnerability management is not working well enough in an enterprise?
A: Common warning signs include long remediation cycles, weak visibility into where vulnerabilities exist, and inconsistent prioritisation of high-risk findings.
Practitioner guidance
- Replace severity-only prioritisation Combine exploitability, reachability, business criticality, ownership and compensating controls before deciding remediation order.
- Map every exposure to a clear owner Tie findings to the application, workload or business service owner so tickets can move beyond generic queue assignment.
- Validate that remediation actually reduced exposure Require post-change checks that confirm the vulnerable service, path or configuration is no longer reachable or exploitable.
Bottom line: Legacy vulnerability management fails when it assumes defenders have time to process findings before exploitation windows close.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:06 pm
Exposure reduction velocity is now the relevant control metric. Security programmes that still measure success by scan coverage or ticket volume are optimising the wrong thing. The attacker advantage comes from the time gap between discovery and exploitation, so governance has to focus on how quickly exposure is materially reduced. Practitioners should treat velocity as an operational risk indicator, not a reporting vanity metric.
A question worth separating out:
Q: What should teams measure to know whether exposure management is working?
A: Track time to containment, secret revocation latency, and the percentage of high-risk systems covered by explicit ownership. If findings regularly sit between discovery and action, the programme is failing where AI-driven testing will pressure it most. Those metrics show whether the organisation can respond at machine speed.
👉 Read our full editorial: Exposure reduction velocity is replacing legacy vulnerability management