Notifications
Clear all
Topic starter
11/08/2026 3:15 pm
TL;DR: Exposure Clock quantifies how many vulnerabilities, including externally exploitable ones, have appeared since the last assessment, reframing pentest output as an exposure-velocity problem rather than a point-in-time result, according to Hadrian. The useful shift is from counting findings to understanding how quickly the attack surface changes between assessments.
NHIMG editorial — based on content published by Hadrian: Quantifying exposure velocity and vulnerability disclosure trends
Questions worth separating out
Q: How should security teams measure exposure drift between pentests?
A: Track the number of new vulnerabilities, especially externally reachable ones, that appear after the last assessment and compare that trend to remediation throughput.
Q: Why do point-in-time pentests miss real-world attack paths?
A: Because exploitability changes faster than most testing cycles.
Q: What breaks when asset context is missing from vulnerability prioritisation?
A: Teams often fix the loudest findings instead of the riskiest ones.
Practitioner guidance
- Implement exposure velocity reporting Track how many new vulnerabilities appear between assessments, then segment that number by internet-facing assets, critical services, and ownership so the metric can drive remediation decisions rather than reporting overhead.
- Bind findings to asset context Require service ownership, network reachability, and identity dependencies for every high-priority issue so teams can distinguish a noisy backlog from an exploitable path.
- Shorten the drift window between assessments Use continuous discovery and change detection to alert on newly exposed assets or services before the next formal pentest cycle closes.
What's in the full article
Hadrian's full post covers the operational detail this post intentionally leaves for the source:
- How the Exposure Clock is calculated across changing assets and externally exploitable findings.
- What the scan and reporting workflow looks like when assessment output is used for remediation prioritisation.
- How agentic testing is positioned as a replacement for manual pentest follow-up.
- The specific operational benefits of tracking asset and configuration changes over time.
👉 Read Hadrian's analysis of exposure velocity and vulnerability disclosure trends →
Exposure velocity and pentest drift: what should teams track now?
Explore further
11/08/2026 3:28 pm
Exposure velocity is the missing governance layer in vulnerability management. Most programmes still treat pentest results as the primary measure of risk, but that model is too static for modern environments. What matters is the rate at which new exposure appears after the last assessment and whether remediation can keep pace. The practitioner conclusion is straightforward: a clean report says less than a declining exposure curve.
A question worth separating out:
Q: Should organisations use exposure metrics instead of traditional vulnerability counts?
A: They should use both, but exposure metrics are more decision-useful when the environment changes quickly. Counts show volume, while exposure velocity shows whether the attack surface is expanding faster than remediation. That makes it a better governance signal for modern estates.
👉 Read our full editorial: Exposure velocity is reshaping vulnerability management priorities
