Topic starter
30/07/2026 10:51 pm
TL;DR: Annual CVE volume has reached record levels, with NIST noting a 263% increase in submissions between 2020 and 2025 as exploit windows shrink and AI accelerates both discovery and abuse, according to Commvault and NIST. The operating model has to shift from slow triage to routine patching, faster validation, and recovery that actually closes the underlying exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Commvault: “The Window Between Discovery and Exploit Is Closing”.
By the numbers:
- NIST noted a 263% increase in CVE submissions between 2020 and 2025.
Key questions
Q: What breaks when vulnerability management still relies on slow triage?
A: Slow triage breaks the assumption that teams have time to enrich, prioritise, and schedule remediation before exploitation starts.
Q: Why does recovery not solve an unpatched vulnerability?
A: Recovery restores availability, but it does not remove the condition that made the system exploitable.
Q: What are the signs that vulnerability response is falling behind?
A: The clearest signs are long-lived backlogs, repeated exceptions for the same classes of CVEs, frequent emergency workarounds and restore activities that happen before remediation is confirmed.
Practitioner guidance
- Implement a fixed patch cadence Run scheduled patch cycles weekly for standard exposure and reserve out-of-band remediation for actively exploited vulnerabilities or internet-facing critical systems.
- Tie recovery to verified closure Do not mark a restore complete until the underlying vulnerability has been patched or the risky configuration has been removed and validated.
- Measure exposure window, not just backlog size Track the elapsed time between vulnerability disclosure, first detection, patch deployment and verified closure so you can see where the process stalls.
Bottom line: Vulnerability management now fails when it is optimised for ranking issues instead of removing exposure fast enough to matter.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:54 pm
Exposure windows are now the real control surface. The article shows that vulnerability management is no longer about whether a team can identify a CVE, but whether it can shrink the time between discovery and safe closure. That changes the governance problem from cataloguing risk to controlling exposure duration. Practitioners should measure how long a weakness remains exploitable, not just whether it was logged.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- Patching addresses only about 10% of privilege escalation techniques, while privilege management covers about 65%, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: How should organisations respond when a critical vulnerability is already being exploited?
A: Containment comes first. Isolate exposed systems, remove or restrict the risky execution path, validate whether the vulnerable component is in use, and then patch based on exposure and privilege impact. If the issue affects administrative or scripting workflows, treat it as a high-priority identity and endpoint control failure, not just a software update.
👉 Read our full editorial: Vulnerability management is shifting from triage to speed and recovery