Topic starter
18/08/2026 2:41 pm
TL;DR: Only a small share of published vulnerabilities are ever seen exploited in the wild, ArmorCode says, so CVSS-only queues can steer teams toward volume instead of exposure. Remediation programs need to weigh severity against likelihood, business context, and reachability on the assets that matter most.
Editorial analysis by NHI Mgmt Group, based on content published by ArmorCode: “How to Prioritize Vulnerability Remediation with Risk, Not Just CVSS”.
Key questions
Q: Why do severity scores fail in modern vulnerability management?
A: Severity scores describe the bug, not the environment.
Q: How do you know if vulnerability prioritisation is working?
A: You should see fewer blocking tickets, faster remediation on exploitable issues, and better alignment between security work and business risk.
Q: How should teams prioritise NHI vulnerabilities when CVSS and EPSS disagree?
A: Treat disagreement as a signal to look at exposure and privilege, not as a reason to pick one score and ignore the other.
Practitioner guidance
- Build a four-signal prioritisation model Rank vulnerabilities using severity, exploit likelihood, business context, and reachability in one workflow so analysts are not forced to triage separate lists.
- Separate exploitable from theoretical findings Use reachability analysis to suppress issues that cannot be triggered in your runtime environment, especially in dependencies that are present but not executed.
- Tie remediation to business exposure Weight internet-facing assets, regulated data, and revenue-critical systems above isolated or non-production environments when the same vulnerability appears in both.
Bottom line: CVSS alone cannot tell teams which vulnerabilities create real exposure in their environment.
Glossary terms: Exploit Prediction Scoring System, Reachability analysis, Business Context, Dynamic risk score
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:25 pm
CVSS-only remediation is exposure theatre: when teams rank everything by severity, they optimise ticket throughput rather than risk reduction. That approach assumes the score is the problem, when the real issue is whether the flaw is reachable, valuable to an attacker, and relevant to the business. The practical conclusion is that remediation governance must be built around exposure, not queue volume.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
- Only 26% of known exploited vulnerabilities were fully remediated in 2025, down from 38% the year before, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: When should organisations treat a medium-severity vulnerability as more urgent than a critical one?
A: When the medium-severity issue is on a reachable, internet-facing, or business-critical system and the critical flaw is isolated, blocked, or otherwise unlikely to be exploited. Prioritisation should follow exploitable exposure, not a score that ignores environment, data sensitivity, and attack path.
👉 Read our full editorial: Risk-based vulnerability triage is better than CVSS-only queues
This post was modified 1 day ago by NHI Mgmt Group