Topic starter
02/08/2026 12:02 pm
TL;DR: Enterprises are publishing 48,185 CVEs in 2025, up 20.6% from 2024, and manual triage cannot keep pace with the volume, context and remediation handoffs required for effective vulnerability management, according to Torq. Prioritization now depends on combining severity, exploitability, asset criticality and automation so security teams can focus on exposure that truly changes risk.
Editorial analysis by NHI Mgmt Group, based on content published by torq: “Smarter Vulnerability Prioritization with AI SOC Automation”.
By the numbers:
- In 2025, 48,185 CVEs were published, a 20.6% increase from 2024.
Key questions
Q: What breaks when vulnerability prioritization stays manual?
A: Manual prioritisation breaks at scale because analysts cannot keep up with scanner volume, data silos and handoff delays.
Q: Why does exploitability data change vulnerability ranking?
A: Exploitability data changes ranking because not every CVE is equally likely to be used in the wild.
Q: What are the signs that a vulnerability prioritization model is failing?
A: The clearest signs are long delays on known exploited vulnerabilities, tickets that lack ownership, duplicate findings across tools, and high-severity work that never maps to real attack paths.
Practitioner guidance
- Automate severity-based first-pass triage Route incoming findings through simple rules that separate obvious low-risk items from exposures that need enrichment, so analysts stop hand-sorting every alert.
- Enrich each finding with asset and exposure context Connect CMDB, inventory and threat-intelligence sources so every vulnerability is evaluated with ownership, internet exposure, business criticality and exploitability data.
- Build context-aware escalation rules Escalate vulnerabilities on externally exposed or regulated systems faster than identical CVEs on isolated assets, and record why each decision was made.
Bottom line: Manual CVE triage no longer scales because backlog growth and handoff delays now define the real exposure window.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:08 pm
Vulnerability prioritization has become a workflow governance problem, not a scoring problem. Severity scores do not decide risk on their own; context, ownership and response routing do. The operational failure is the gap between identification and action, where a finding can be technically known but still practically unmanaged. Practitioners should treat prioritization as a control path that spans inventory, enrichment, assignment and verification.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How do teams govern vulnerability ownership across security and IT?
A: Teams should make asset ownership explicit, because prioritization only works when findings can be matched to the right service, platform or application owner. Governance should define who receives the finding, who approves remediation, and how context is preserved as the issue moves between security, infrastructure and application teams.
👉 Read our full editorial: Vulnerability prioritization is becoming an automation problem