Topic starter
25/10/2026 11:08 am
TL;DR: 1,296 findings shows how quickly raw counts can swell, in Nullify's case work on vulnerability noise and reachability analysis. Boards need evidence of risk removed, not busy output, because volume alone can hide unchanged exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Nullify: “The Vulnerability-Count Arms Race Is a Vanity Metric”.
Key questions
Q: What breaks when vulnerability dashboards are driven by raw finding totals?
A: They break prioritisation.
Q: What breaks when reachability analysis is missing from vulnerability triage?
A: Without reachability analysis, teams rely on scan volume instead of evidence.
A: Measure effectiveness by verified risk reduction, not by the number of findings produced or closed.
Practitioner guidance
- Define closure states separately Separate fixed, suppressed, allowlisted, deduplicated, and false-positive outcomes in reporting so “resolved” never disguises what actually happened.
- Gate board metrics on verified risk Report counts only after validation, and pair them with evidence of reachable risk removed rather than raw scanner output.
- Tune detections against noisy rule sets Review the highest-noise rules first and strip out patterns that generate volume without changing true-positive coverage.
Bottom line: Raw vulnerability counts no longer tell leaders whether a security programme is actually reducing exposure.
Glossary terms: Reachability analysis, False Positive, Real Risk Reduction, Findings Noise
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Raw vulnerability counts have become governance theatre. A number that rises because detection got cheaper is not a measure of control, and it should not be used to defend budget or maturity. The real question is whether the programme can show that exposed risk went down, not whether the scanner or model produced more findings. Leaders should treat count inflation as a metric design failure, not a tooling success.
A question worth separating out:
Q: What is the difference between fixing vulnerabilities and suppressing noisy findings?
A: Fixing removes the weakness from the system and should survive re-scan. Suppressing, allowlisting, or deduplicating changes how a finding is handled, but it does not prove the underlying issue was eliminated. Both can be valid outcomes in a programme, but they should be reported separately so leaders do not confuse noise reduction with remediation.
👉 Read our full editorial: Raw vulnerability counts no longer measure real security control
This post was modified 7 days ago by NHI Mgmt Group