Topic starter
19/08/2026 3:33 pm
TL;DR: 65% of C-level respondents were very confident versus 36% at middle-management level, a survey finding that highlights a confidence split in Intruder's research. Internet-facing exposure narrows the time to remediate, so control visibility has to improve before disclosure turns into exploitation.
Editorial analysis by NHI Mgmt Group, based on content published by Intruder: “The Vulnerabulletin Issue #5”.
By the numbers:
- 65% of C-level executives said they were very confident in their ability to identify and remediate critical threats.
- 36% of middle-management respondents said they were very confident in their ability to identify and remediate critical threats.
- Attackers often exploit critical vulnerabilities within 24 to 48 hours of disclosure.
Key questions
Q: Why do executives and middle management often disagree on security confidence?
A: They are usually looking at different evidence.
Q: What are the signs that an attack surface reduction program is not working?
A: Common warning signs include unmanaged shadow IT, still-open ports, outdated software, excessive permissions, and third-party integrations that are not continuously reviewed.
Q: What breaks when internet-facing services are not tightly governed?
A: Exposed services collapse the gap between discovery and exploitation.
Practitioner guidance
- Reduce unnecessary internet exposure Inventory services that are reachable from the public internet and close any path that is not required for business or support.
- Tie assurance to live asset exposure Replace high-level confidence reporting with a review of active exposure, unresolved exceptions, and time-to-remediate for internet-facing services.
- Review privileged access on public services Map the identities, service accounts, and administrative workflows behind every externally reachable system.
Bottom line: Midmarket teams can look more confident at the top of the organisation than they are in practice, especially when operational visibility into exposure is incomplete.
Glossary terms: Internet-Facing Exposure, Attack Surface Management, Exposure management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
19/08/2026 4:15 pm
Exposure is now a governance problem, not just a vulnerability problem. Midmarket teams do not fail only because they miss patches; they fail because too many services remain reachable in the first place, turning every disclosure into an urgent containment event. The meaningful control boundary is pre-exposure reduction, because the response window is too small to rely on patching alone. Practitioners should treat unnecessary public reachability as a standing risk condition.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams govern privileged access after authentication?
A: Security teams should treat authorization as the real control layer and scope privilege at the moment it is needed. That means moving away from persistent admin rights, requiring task-specific approvals, and ensuring every elevation is tied to a target system, a reason, and an audit trail that survives incident review.
👉 Read our full editorial: Midmarket security teams face confidence gaps and exposed attack surfaces