Topic starter
01/08/2026 9:00 pm
TL;DR: Backlog now matters as part of the attack path, Tonic reports, because unresolved exposures can stay reachable long enough to be reused. Vulnerability programs need faster ownership and validation or known issues keep counting as live risk.
Editorial analysis by NHI Mgmt Group, based on content published by Tonic: “Vulnerability Management is Too Slow for the Mythos Era”.
Key questions
Q: Why does prioritizing vulnerabilities by business context improve remediation outcomes?
A: Prioritizing by business context reduces wasted effort on low-value findings and directs scarce resources toward exposures that could disrupt important services.
Q: What are the signs that vulnerability management is not working well enough in an enterprise?
A: Common warning signs include long remediation cycles, weak visibility into where vulnerabilities exist, and inconsistent prioritisation of high-risk findings.
Q: What breaks when vulnerability management stops at scanning and ticketing?
A: Teams create a false sense of progress.
Practitioner guidance
- Replace severity-only prioritisation Combine exploitability, reachability, business criticality, ownership and compensating controls before deciding remediation order.
- Map every exposure to a clear owner Tie findings to the application, workload or business service owner so tickets can move beyond generic queue assignment.
- Validate that remediation actually reduced exposure Require post-change checks that confirm the vulnerable service, path or configuration is no longer reachable or exploitable.
Bottom line: Legacy vulnerability management fails when it assumes defenders have time to process findings before exploitation windows close.
Glossary terms: Exposure Reduction Velocity, Exploitability context, Compensating Control, Validated remediation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
01/08/2026 9:06 pm
Exposure reduction velocity is now the relevant control metric. Security programmes that still measure success by scan coverage or ticket volume are optimising the wrong thing. The attacker advantage comes from the time gap between discovery and exploitation, so governance has to focus on how quickly exposure is materially reduced. Practitioners should treat velocity as an operational risk indicator, not a reporting vanity metric.
A question worth separating out:
Q: What should teams measure to know whether exposure management is working?
A: Track time to containment, secret revocation latency, and the percentage of high-risk systems covered by explicit ownership. If findings regularly sit between discovery and action, the programme is failing where AI-driven testing will pressure it most. Those metrics show whether the organisation can respond at machine speed.
👉 Read our full editorial: Exposure reduction velocity is replacing legacy vulnerability management