Topic starter
14/09/2026 10:09 am
TL;DR: CVSS-only triage breaks down as FIRST projects roughly 66,000 CVEs in 2026, according to ArmorCode, because severity scores cannot separate exploitable production exposure from low-risk noise. Risk-based vulnerability management becomes the practical answer when remediation capacity, business context, and attackability all have to be weighed together.
Editorial analysis by NHI Mgmt Group, based on content published by ArmorCode: “Building a Risk-Based Vulnerability Management Program for 2026”.
Key questions
Q: Why does CVSS-only triage fail when vulnerability volumes surge?
A: CVSS-only triage fails because it ranks technical severity without accounting for reachability, exploitability, asset criticality, or business impact.
A: Security teams should prioritise vulnerabilities by business impact, exploitability, and the importance of the affected system.
Q: What are the signs that a vulnerability prioritization model is failing?
A: The clearest signs are long delays on known exploited vulnerabilities, tickets that lack ownership, duplicate findings across tools, and high-severity work that never maps to real attack paths.
Practitioner guidance
- Correlate severity with asset context Combine CVSS with reachability, business criticality, ownership, and data sensitivity before assigning remediation priority.
- Build tiered remediation queues Route exploitable public-facing issues to immediate remediation, internal-only issues to scheduled work, and low-reachability findings to batch handling.
- Track risk-weighted metrics Measure MTTR by risk tier, not as one blended average, and trend the backlog by risk weight rather than raw ticket count.
Bottom line: Severity-only triage is too blunt for 2026-scale vulnerability volume because it cannot distinguish exploitable production exposure from low-risk noise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
Risk-based vulnerability management is now a governance requirement, not a tuning exercise. When finding volume outpaces human review, severity scores stop functioning as decision support and start functioning as queue inflation. Security leaders need a model that ties remediation to business consequence, not just technical description. The governance question is no longer whether to use CVSS, but how to stop CVSS from dominating decisions it was never designed to make.
A question worth separating out:
Q: How do vulnerability teams and identity teams share accountability for exposed systems?
A: Identity and vulnerability teams share accountability when a vulnerable system protects authentication, authorisation, or privileged access paths. Vulnerability teams need to surface the exposure, while IAM and PAM teams need to understand which identities, entitlements, or workflows make that exposure more dangerous. The shared goal is to reduce attacker reachability, not just close tickets.
👉 Read our full editorial: Risk-based vulnerability management is becoming mandatory at 2026 scale