Vulnerability counts: what are teams actually proving now?

TL;DR: Raw vulnerability counts have become easy to inflate with cheap AI-assisted detection and noisy rules, so numbers like “we surfaced 1,296 vulnerabilities” now say more about generation speed than actual risk, according to Nullify. Verified risk removed, not volume found or closed, is the only defensible measure of control.

Editorial analysis by NHI Mgmt Group, based on content published by Nullify: “The Vulnerability-Count Arms Race Is a Vanity Metric”.

Key questions

Q: How should security teams measure vulnerability programme effectiveness without relying on raw counts?

A: Measure effectiveness by verified risk reduction, not by the number of findings produced or closed.

Q: What breaks when vulnerability dashboards are driven by raw finding totals?

A: They break prioritisation.

Q: What breaks when reachability analysis is missing from vulnerability triage?

A: Without reachability analysis, teams rely on scan volume instead of evidence.

Practitioner guidance

• Define closure states separately Separate fixed, suppressed, allowlisted, deduplicated, and false-positive outcomes in reporting so “resolved” never disguises what actually happened.
• Gate board metrics on verified risk Report counts only after validation, and pair them with evidence of reachable risk removed rather than raw scanner output.
• Tune detections against noisy rule sets Review the highest-noise rules first and strip out patterns that generate volume without changing true-positive coverage.

Bottom line: Raw vulnerability counts no longer tell leaders whether a security programme is actually reducing exposure.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →