Topic starter
02/08/2026 12:11 pm
TL;DR: Cisco’s end-of-sale and end-of-life for Vulnerability Management, formerly Kenna Security, marks a category shift from RBVM toward continuous, contextual exposure management that prioritises business impact, remediation orchestration, and increasingly autonomous workflows, according to Tonic. The governance problem is no longer finding more vulnerabilities, but preserving context and reducing exposure across identities, assets, and attack paths.
Editorial analysis by NHI Mgmt Group, based on content published by Tonic: “Kenna is Sunsetting. But the Sun Will Rise Again.”.
Key questions
Q: What breaks when organisations still rely on severity-only vulnerability management?
A: They fix the wrong things first.
Q: Why does contextual prioritisation matter for remediation teams?
A: Contextual prioritisation matters because the same vulnerability can have very different risk depending on asset criticality, privilege, compensating controls, and business service impact.
Q: What are the signs that contextual exposure management is failing?
A: Common signs include overwhelming issue volumes, repeated false positives, slow escalation to the right owners, and remediation efforts aimed at the wrong assets.
Practitioner guidance
- Preserve remediation context during migrations Carry forward ownership, exception rationale, tags, risk acceptance, and prioritisation logic so the programme does not reset when the platform changes.
- Prioritise by attack path and business impact Rank exposures using asset criticality, likely exploitation paths, and the controls that already reduce or amplify the exposure.
- Validate queue parity before cutover Run the old and new workflows in parallel long enough to compare deduplication, asset matching, and ticket routing outcomes.
Bottom line: RBVM improved prioritisation, but it still treated vulnerabilities as the main unit of risk, which is no longer enough for modern hybrid environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:14 pm
Exposure management is replacing vulnerability counts as the organising logic for remediation. Counting findings was always a proxy for risk, not risk itself. Once asset sprawl, hybrid infrastructure, and business-critical dependencies enter the picture, the control question changes from “what exists?” to “what exposure can actually be exploited?” Practitioners should treat this as a governance reset, not a tooling refresh.
A question worth separating out:
Q: Should organisations replace RBVM with continuous exposure management?
A: Yes, when RBVM no longer reflects the pace or complexity of the environment. Continuous exposure management is better suited to hybrid estates, shared controls, and business-driven remediation because it measures exposure as a moving condition rather than a static vulnerability list.
👉 Read our full editorial: Kenna’s retirement signals exposure management’s shift beyond RBVM