Risky tech ranking: what it means for vulnerability prioritisation

TL;DR: Coalition’s Q2 2026 Risky Tech Ranking shows the vendor set grew from 10,388 to 10,530 while contributing vulnerabilities rose from 49,320 to 58,098, and the average vendor score increased 110% since Q2 2025. Exploitability, not raw CVE count alone, is becoming the more useful way to think about technology risk.

Editorial analysis by NHI Mgmt Group, based on content published by Coalition: “Risky Tech Ranking: Q2 2026 Updates”.

By the numbers:

• The Average Vendor Score increased 110% since Q2 2025.

Key questions

Q: What should security teams do when an exploited CVE is tied to a third-party product?

A: Treat the issue as an operational assignment problem, not just a scanner finding.

Q: Why does exploitability matter more than severity in CTEM prioritisation?

A: Severity alone does not show whether an attacker can reach the exposure or turn it into a compromise path.

Q: What are the signs that vendor and account risk is increasing in practice?

A: Common warning signs include unusual access times, abnormal data downloads or transfers, privilege escalation attempts, lateral movement patterns, exposed vendor credentials, and a drop in vendor security ratings.

Practitioner guidance

• Prioritise exploitability over raw CVE volume Use exploitability-weighted review to decide which vendors and products move to the front of patch, containment, and exception queues.
• Map risky products to identity and access dependencies Inventory which externally facing products sit on authentication, privilege, token, or administrative paths so a weakness can be tied to access exposure.
• Shorten remediation SLAs for products with rising exposure Set tighter internal deadlines when a product’s vulnerability count and exploitability profile both trend upward across consecutive quarters.

Bottom line: The core issue is not just how many flaws exist, but how quickly exploitable weaknesses change the risk profile of third-party technology.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →