Topic starter
01/08/2026 9:01 pm
TL;DR: Vulnerability exploitation is now the most common known initial access vector, rising to 31%, according to Cogent, while only 26% of detected CISA Known Exploited Vulnerabilities were fully remediated and median time to full resolution reached 43 days. The control problem has shifted from finding exposure to proving closure fast enough to beat exploitation.
Editorial analysis by NHI Mgmt Group, based on content published by Cogent: “The 2026 Verizon DBIR Shows Vulnerability Management Has Become a Remediation Problem”.
By the numbers:
- Vulnerability exploitation is now the most common known initial access vector for breaches at 31%, according to Cogent.
Key questions
Q: What breaks when vulnerability scanning produces more findings than teams can fix?
A: Remediation turns into a triage bottleneck.
Q: Why do reachable vulnerabilities create more risk than severity scores suggest?
A: Because exploitability depends on context, not just the label.
Q: How do security teams know whether Teams remediation is working?
A: They should measure dwell time, removal latency, and the percentage of malicious messages removed before any user interaction.
Practitioner guidance
- Establish verified remediation as the closing control Do not treat ticket closure as remediation completion until validation proves the exposure is no longer reachable or exploitable.
- Prioritise by exploitability and reachability Combine threat intelligence, asset exposure, business criticality, and ownership so teams fix what attackers can actually reach first.
- Assign a named owner for every high-risk exposure Require a responsible team and a safe fix path for each exploitable vulnerability, including compensating control options where patching is delayed.
Bottom line: Vulnerability management now fails most often at the point where a finding must become a verified fix, not at the point of discovery.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:07 pm
Vulnerability management is now a closure discipline, not a discovery discipline. The article shows that organisations already know how to generate findings, but they struggle to convert those findings into verified risk reduction. That shifts the centre of gravity from scanner coverage to operational ownership, safe change execution, and proof that exposure is actually gone. Practitioners should treat remediation throughput as the primary control objective.
A few things that frame the scale:
- Credential abuse across the entire attack chain, not just initial access, appears in 39% of all breaches, according to the 2026 Verizon Data Breach Investigations Report.
A question worth separating out:
Q: Should vulnerability remediation be coordinated with IAM and PAM teams?
A: Yes, when the vulnerable asset can reach privileged systems, automation, or sensitive integrations. In those cases, the impact of exploitation depends partly on what identities and access paths the asset can touch. IAM and PAM teams help reduce blast radius by reviewing privileges, service accounts, and downstream access that could turn one exposed system into broader compromise.
👉 Read our full editorial: Vulnerability management is becoming a remediation problem