Topic starter
01/07/2026 1:54 am
TL;DR: Vulnerability management is breaking under production scale because AI-driven attacks can weaponize a newly discovered flaw within hours, long before teams can patch or schedule downtime, according to Aqua Security. The real control gap is the time between discovery and remediation, and runtime compensating controls now matter more than scan volume.
Editorial analysis by NHI Mgmt Group, based on content published by Aqua Security: “How Do You Protect a Workload You Cannot Afford to Patch Right Now?”.
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
Key questions
Q: What breaks when a production container vulnerability cannot be patched immediately?
A: The usual patch-first response breaks because the workload stays live while the exploit window remains open.
Q: When should teams prioritise runtime protection over waiting for a patch window?
A: Teams should prioritise runtime protection when the workload is critical, the vulnerability is already being targeted, or patching would require downtime that the business cannot absorb.
Q: How do security teams know if runtime protection is actually working?
A: Look for evidence that suspicious behaviour is detected fast enough to contain it before the session or workload expands the blast radius.
Practitioner guidance
- Prioritise unpatched production CVEs by exploitability window Rank container vulnerabilities by how long they are likely to remain exposed before a safe patch or rebuild can be applied, not by scan severity alone.
- Activate runtime policies for high-risk running workloads Use runtime compensating controls for the highest-priority container vulnerabilities where patching cannot happen immediately without service impact.
- Validate new policies in audit mode before enforcement Observe what a runtime control would block in production before turning it on, so the team can confirm the policy matches the exploit condition.
Bottom line: Container vulnerability risk is no longer governed only by scan coverage or patch backlog size.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 23 hours ago by NHI Mgmt Group
01/07/2026 2:12 am
Production vulnerability management is now a remediation-latency problem, not a scan-volume problem. Aqua’s core point is that discovery outpaces safe remediation in container environments, so the real exposure is the time between finding a flaw and being able to change the running workload. That shifts the control conversation away from more findings and toward whether the environment can be protected while engineering work catches up. Practitioners should evaluate every high-severity container CVE through that latency lens.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What should security teams do when a container CVE has no immediate fix?
A: They should classify the workload by business criticality, enable a compensating runtime control where available, and keep patching on the normal schedule instead of treating the vulnerability as an emergency rebuild. That approach preserves uptime while shrinking exploitability.
👉 Read our full editorial: Runtime protection closes the container patching gap in production
This post was modified 23 hours ago by NHI Mgmt Group