Security teams may be fixing more vulnerabilities without meaningfully reducing their breach risk, according to an article by Picus Security. The article cites a Gartner report stating that fewer than 10% of vulnerabilities are exploited, while many are still treated as urgent. It also says CVSS scores alone do not reliably indicate exploitation or business impact.
Gartner predicts that by 2028, organizations prioritizing exposures through threat intelligence, asset context, exploitability modeling and security control validation will reduce breach likelihood by at least 70% compared with organizations relying mainly on CVSS-based prioritization.
The framework’s four elements answer different questions. Threat intelligence identifies vulnerabilities attackers are exploiting. Asset context shows whether an affected system supports critical operations, handles regulated data or provides a route to more valuable systems. Exploitability models, such as EPSS, estimate the likelihood of exploitation, while control validation tests whether an attack could succeed in an organization’s specific environment.
The article cautions that exploitability scores are estimates, not proof. They can help identify exposures for further testing, but validation is needed to determine what is exploitable in a particular environment. That assessment should account for existing defenses, including segmentation, endpoint protection, detection coverage and identity controls.
Picus says its platform combines the four elements in a continuous process of discovery, validation, prioritization and remediation mobilization. Its validation approaches include testing real exploit paths against reachable production assets and assessing attack techniques against controls without launching an exploit. The company says these methods can produce evidence-based assessments for assets that cannot safely be tested live.
Picus also reports results from its customers, including controls blocking or detecting roughly twice as many attacks within three months, an 89% reduction in response time to emerging threats, and a 92% decrease in missed remediation deadlines for high and critical vulnerabilities. The article says one customer reduced its critical ticket backlog by 98%; these figures are company-reported.
Sources: The Hacker News.