Vulnerability remediation vs mitigation: what risk teams need to decide

TL;DR: Perfect patching is unrealistic because vulnerability remediation must be balanced with mitigation, especially when 48,000 CVEs were published in 2025 and 95 to 97 percent of vulnerabilities are never exploited in the wild, according to ArmorCode. Risk-based exposure management now depends on asset criticality, exploitability, and temporary controls that do not become permanent debt.

NHIMG editorial — based on content published by ArmorCode: Vulnerability Remediation vs. Mitigation: Managing Risk in Modern Environments

By the numbers:

• Research consistently shows that 95 to 97 percent of reported vulnerabilities are never exploited in the wild.

Questions worth separating out

Q: How should security teams decide between remediation and mitigation?

A: Start with exploitability, asset criticality, and deployment feasibility rather than severity alone.

Q: When does mitigation create more risk than it reduces?

A: Mitigation becomes risky when it is left in place without review, documentation, or a plan to remediate the underlying flaw.

Q: What do security teams get wrong about vulnerability backlogs?

A: They often treat the backlog as a queue of work rather than a warehouse of unresolved risk.

Practitioner guidance

• Build separate workflows for remediation and mitigation Create distinct states in your vulnerability system for permanent fix, temporary containment, and accepted risk.
• Prioritise by exploitability and asset context Combine EPSS, CISA KEV, network reachability, and business criticality before assigning SLAs.
• Tie compensating controls to identity scope Where vulnerabilities sit near service accounts, tokens, or privileged automation, document exactly which non-human identities are being protected and whether their access is still necessary.

What's in the full article

ArmorCode's full blog covers the operational detail this post intentionally leaves for the source:

• How ArmorCode maps vulnerability findings from SAST, DAST, SCA, cloud, and infrastructure scanners into a single deduplicated workflow
• The decision logic for choosing a mitigation path versus a permanent fix in different operational conditions
• Examples of shared ticketing and reporting patterns for security and IT operations teams
• The platform-oriented details behind automation and routing in a vulnerability workflow

👉 Read ArmorCode's full blog on vulnerability remediation versus mitigation →

Vulnerability remediation vs mitigation: what risk teams need to decide?

Explore further

View Full Forum →  |  NHI Foundation Course →