Topic starter
18/08/2026 2:17 pm
TL;DR: CISA’s new directive replaces severity-first vulnerability triage with exposure, reachability, exploitability, and business context, according to LEGIT Security, reflecting a broader shift from counting findings to deciding which ones actually change risk. That matters because finite remediation capacity is now the constraint, not discovery volume.
Editorial analysis by NHI Mgmt Group, based on content published by LEGIT Security: “The Government Just Made Our Case: Stop Fixing Everything, Fix What Matters.”.
Key questions
Q: What breaks when vulnerability remediation still relies on severity scores alone?
A: Severity-only triage breaks down when the same flaw appears in different exposure states, because the score cannot tell you which system is public, mission-critical or already exploited.
A: Prioritising by exposure context is more effective because a high severity flaw is not equally dangerous everywhere.
Q: What are the signs that a vulnerability prioritization model is failing?
A: The clearest signs are long delays on known exploited vulnerabilities, tickets that lack ownership, duplicate findings across tools, and high-severity work that never maps to real attack paths.
Practitioner guidance
- Rebuild triage rules around exposure and reachability Classify each vulnerability by whether the affected asset is internet-facing, internally reachable, or effectively unreachable in production.
- Incorporate KEV and exploitation evidence into prioritisation Flag any finding that appears in the KEV catalog or has credible exploitation evidence as an immediate candidate for accelerated remediation, regardless of whether the scanner score looks ordinary.
- Separate deployed risk from theoretical risk Exclude components that are not actually shipped, activated, or reachable from the same workflow that handles customer-facing assets.
Bottom line: CISA’s new policy replaces severity-first vulnerability triage with context-based decisions about exposure, reachability, exploitability and business impact.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:10 pm
Risk-based vulnerability management is now the right control plane for modern AppSec. The old severity-first model assumes that a higher score always deserves earlier work, but that assumption fails as soon as exposure and exploitability diverge from the scanner output. CISA’s policy recognises that remediation capacity is finite and must be allocated to the findings most likely to alter actual attack paths. For practitioners, the implication is clear: triage must become a decision system, not a score list.
A question worth separating out:
Q: How should teams decide which security findings to fix first?
A: Prioritise findings that are both reachable and tied to active code paths. A raw alert list is not enough because many issues will never be exploitable in practice. The best triage model combines severity with code-path evidence, so engineering time goes to defects that can actually affect production risk.
👉 Read our full editorial: CISA risk-based vulnerability prioritization changes AppSec triage