Topic starter
11/11/2026 6:02 pm
TL;DR: 26% of critical vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog were fully remediated in 2025, according to Dataminr’s use of Verizon DBIR 2026 data. Vulnerability programs need exposure context, not just severity scores, or they keep fixing the wrong things first.
Editorial analysis by NHI Mgmt Group, based on content published by Dataminr: “Vulnerability Prioritization: Why Patching Faster Isn’t a Strategy”.
Key questions
Q: Why does CVSS alone mislead remediation queues?
A: CVSS alone misleads remediation queues because it measures technical severity, not your exploitable exposure.
Q: How do compensating controls change vulnerability priority?
A: Compensating controls lower priority when they reduce exploitability or containment risk, even if the vulnerability remains unpatched.
A: Treat CVSS as a baseline, then re-rank findings using exploit intelligence, asset criticality, and internet exposure.
Practitioner guidance
- Build a four-stage prioritisation funnel Start with all scanner findings, then narrow to actively exploited or likely-to-be-exploited issues, then remove items already covered by effective controls, and finally rank by business impact.
- Validate compensating controls before deferring a fix Confirm whether preventive or detective controls actually block the relevant attack technique, rather than assuming coverage from a policy, diagram or log-only setting.
- Tie remediation to asset criticality and loss scenarios Document the business function, revenue exposure or operational dependency behind each high-priority vulnerability so the ranking can be defended in dollars and likelihood.
Bottom line: Severity-based patch queues are too blunt to reflect attacker selection, exposure state or business consequence.
Glossary terms: Vulnerability Prioritisation, Known Exploited Vulnerability, Compensating Control, Exposure management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Severity-first remediation is a governance shortcut, not a risk strategy. CVSS helps describe a flaw, but it does not tell a security team whether the weakness is reachable, already exploited or economically material. Once remediation becomes a queueing problem, the queue has to reflect attacker behaviour and business consequence, not just technical score. The practitioner implication is that vulnerability governance must move from ranking defects to ranking exposure.
A few things that frame the scale:
- The median time to fully patch a vulnerability in CISA's Known Exploited Vulnerabilities catalog rose to 43 days, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: What happens when early warning arrives before public disclosure?
A: When early warning arrives before public disclosure, defenders get a short window to re-rank exposures before widespread scanning begins. The usual response is to patch, disable the vulnerable feature, tighten segmentation, or add temporary blocking controls while validating reachability. That warning should lift priority for exposed assets, especially those already mapped to critical services or privileged access paths.
👉 Read our full editorial: Vulnerability prioritization becomes a threat-informed exposure funnel