Topic starter
18/08/2026 2:41 pm
TL;DR: Only 2-7% of published vulnerabilities are ever seen exploited in the wild, according to ArmorCode's analysis, which argues that CVSS-only queues push teams toward volume over real exposure. Risk-based remediation becomes defensible when severity, likelihood, business context, and reachability are combined into one ranked decision model.
Editorial analysis by NHI Mgmt Group, based on content published by ArmorCode: “How to Prioritize Vulnerability Remediation with Risk, Not Just CVSS”.
Key questions
Q: How should teams prioritise NHI vulnerabilities when CVSS and EPSS disagree?
A: Treat disagreement as a signal to look at exposure and privilege, not as a reason to pick one score and ignore the other.
Q: Why do severity scores fail in modern vulnerability management?
A: Severity scores describe the bug, not the environment.
Q: How do you know if vulnerability prioritisation is working?
A: You should see fewer blocking tickets, faster remediation on exploitable issues, and better alignment between security work and business risk.
Practitioner guidance
- Build a four-signal prioritisation model Rank vulnerabilities using severity, exploit likelihood, business context, and reachability in one workflow so analysts are not forced to triage separate lists.
- Separate exploitable from theoretical findings Use reachability analysis to suppress issues that cannot be triggered in your runtime environment, especially in dependencies that are present but not executed.
- Tie remediation to business exposure Weight internet-facing assets, regulated data, and revenue-critical systems above isolated or non-production environments when the same vulnerability appears in both.
Bottom line: CVSS alone cannot tell teams which vulnerabilities create real exposure in their environment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:25 pm
CVSS-only remediation is exposure theatre: when teams rank everything by severity, they optimise ticket throughput rather than risk reduction. That approach assumes the score is the problem, when the real issue is whether the flaw is reachable, valuable to an attacker, and relevant to the business. The practical conclusion is that remediation governance must be built around exposure, not queue volume.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
- Only 26% of known exploited vulnerabilities were fully remediated in 2025, down from 38% the year before, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: When should organisations treat a medium-severity vulnerability as more urgent than a critical one?
A: When the medium-severity issue is on a reachable, internet-facing, or business-critical system and the critical flaw is isolated, blocked, or otherwise unlikely to be exploited. Prioritisation should follow exploitable exposure, not a score that ignores environment, data sensitivity, and attack path.
👉 Read our full editorial: Vulnerability remediation prioritization needs risk, not CVSS alone