Topic starter
02/08/2026 11:55 am
TL;DR: Severity scores alone do not reflect real-world exploitation risk, according to Anomali’s whitepaper on threat-informed vulnerability prioritization. The paper argues that exploit intelligence, asset criticality, and campaign relevance should drive remediation decisions, not raw scores alone, because exposure reduction and executive reporting improve when patching is tied to business risk.
Editorial analysis by NHI Mgmt Group, based on content published by Anomali: “Threat-Informed Vulnerability Prioritization with Anomali”.
Key questions
A: Prioritise by combining exploitability, asset criticality, compensating controls, and process ownership.
Q: Why can a vulnerability with a high CVSS score still be a lower remediation priority in practice?
A: CVSS measures theoretical technical severity, but it does not tell you whether the flaw is being exploited, whether exploit code is mature, or whether the affected asset matters to the business.
Q: What breaks when vulnerability management ignores attack paths?
A: When vulnerability management ignores attack paths, teams end up fixing issues that are technically severe but operationally irrelevant while leaving reachable exposures open.
Practitioner guidance
- Build exploit-context scoring into patch triage Combine severity with exploit intelligence, asset criticality, and campaign relevance before assigning remediation queues.
- Separate business-critical assets into a fast lane Create a distinct remediation path for crown-jewel systems, privileged services, and externally exposed assets so their vulnerabilities are reviewed faster than the general backlog.
- Use campaign activity to trigger re-prioritisation Escalate vulnerabilities that appear in active threat campaigns or mass exploitation waves, even when their nominal score is lower than other open items.
Bottom line: Severity scores are not a reliable stand-alone guide to remediation order when exploit context is missing.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:03 pm
Exploit context is the missing governance layer in score-driven remediation. Severity-only queues treat every high score as equally urgent, but attackers do not exploit environments that way. The better control question is whether the vulnerability is both exploitable and relevant to a critical business path. Practitioners should treat exploit intelligence as a governance input, not an optional enrichment.
A few things that frame the scale:
- Patching addresses only about 10% of privilege escalation techniques, while privilege management covers about 65%, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: How do organisations know whether threat-informed prioritisation is working?
A: Look for faster remediation of vulnerabilities tied to active exploitation, shorter exposure windows on critical assets, and reports that explain why certain issues moved ahead of others. If those signals are missing, prioritisation is still driven mainly by scanner output rather than risk.
👉 Read our full editorial: Threat-informed vulnerability prioritization needs exploit context