Topic starter
02/08/2026 12:02 pm
TL;DR: Manual CVE triage cannot keep pace with 48,185 CVEs in 2025, and backlog growth plus handoff delays now shape the real exposure window, according to Torq. Prioritization works better when severity is combined with exploitability, asset criticality and compensating controls.
Editorial analysis by NHI Mgmt Group, based on content published by torq: “Smarter Vulnerability Prioritization with AI SOC Automation”.
By the numbers:
- In 2025, 48,185 CVEs were published, a 20.6% increase from 2024.
Key questions
Q: Why does exploitability data change vulnerability ranking?
A: Exploitability data changes ranking because not every CVE is equally likely to be used in the wild.
Q: What are the signs that a vulnerability prioritization model is failing?
A: The clearest signs are long delays on known exploited vulnerabilities, tickets that lack ownership, duplicate findings across tools, and high-severity work that never maps to real attack paths.
Q: What breaks when vulnerability prioritization stays manual?
A: Manual prioritisation breaks at scale because analysts cannot keep up with scanner volume, data silos and handoff delays.
Practitioner guidance
- Automate severity-based first-pass triage Route incoming findings through simple rules that separate obvious low-risk items from exposures that need enrichment, so analysts stop hand-sorting every alert.
- Enrich each finding with asset and exposure context Connect CMDB, inventory and threat-intelligence sources so every vulnerability is evaluated with ownership, internet exposure, business criticality and exploitability data.
- Build context-aware escalation rules Escalate vulnerabilities on externally exposed or regulated systems faster than identical CVEs on isolated assets, and record why each decision was made.
Bottom line: Manual CVE triage no longer scales because backlog growth and handoff delays now define the real exposure window.
Glossary terms: Vulnerability Management Prioritization, Compensating Control, Asset criticality, Decision latency
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
02/08/2026 1:08 pm
Vulnerability prioritization has become a workflow governance problem, not a scoring problem. Severity scores do not decide risk on their own; context, ownership and response routing do. The operational failure is the gap between identification and action, where a finding can be technically known but still practically unmanaged. Practitioners should treat prioritization as a control path that spans inventory, enrichment, assignment and verification.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How do teams govern vulnerability ownership across security and IT?
A: Teams should make asset ownership explicit, because prioritization only works when findings can be matched to the right service, platform or application owner. Governance should define who receives the finding, who approves remediation, and how context is preserved as the issue moves between security, infrastructure and application teams.
👉 Read our full editorial: Vulnerability prioritization is becoming an automation problem