Vulnerability Management Should Focus on How Flaws Affect Each Organization
Summary
Experts argue that organizations should prioritize vulnerabilities based on their own assets, exposure and attacker activity—not scores alone—as growing volumes of flaws strain manual processes.
Key points
- One organization’s vulnerability-tracking system reportedly failed after fewer than 1,000 CVEs generated tens of millions of vulnerable asset instances.
- Root Evidence says only 1.4% of CVEs are exploited; experts argue organizations can further narrow priorities to flaws that affect their own environments.
- The article says AI may add to vulnerability volume, but Root Evidence has not seen data showing that AI will increase vulnerability impact and volume.
- Experts recommend weighing active exploitation, asset exposure, existing controls and remediation effort rather than relying on CVSS scores alone.
- Automation can make some fixes easier, while existing controls may mitigate flaws that are not readily exploitable in an organization’s environment.
- Experts say better data and expert input could help teams move from manual, score-driven vulnerability management toward organization-specific risk management.
Article Details
- Topic
- Vulnerability management prioritization based on organizational exposure, exploit activity, and available controls rather than vulnerability scores alone.
People
David LindnerCSO of Contrast Security; discussed application vulnerability scanning and shifting from vulnerability management to risk management.Ed BellisCEO of Empirical Security; discussed remediation workloads and data-driven vulnerability management.Jay JacobsFounder of Empirical Security; discussed vulnerability volumes, prioritization data, and compensating controls.Jeremiah GrossmanCEO of Root Evidence; discussed exploitation rates and prioritizing vulnerabilities based on attacker activity.