Vulnerability Management Isn't About the Score — It's About How It Applies to You

Organizations are grappling with the monumental task of tracking millions of vulnerabilities across numerous systems. A transformation in vulnerability management is essential, yet this does not imply abandoning prioritization and data-driven methodologies. Instead, organizations must concentrate on vulnerabilities that have direct implications for them— the current overload of flaws necessitates this shift.

A recent incident highlighted the strain on systems when one organization encountered a breakdown following September's Patch Tuesday release. As reported by Jay Jacobs, founder of Empirical Security, their system was unable to accommodate the influx of new vulnerability instances. Although the figure was under 1,000 CVEs, these vulnerabilities were dispersed across tens of millions of at-risk assets.

This experience is not isolated. Patch Tuesdays continue to set new records in the number of releases, some classified as emergencies. Additionally, automated tools and artificial intelligence (AI) are uncovering more vulnerabilities and generating numerous alerts. Consequently, security teams face significant challenges as they endeavor to manage the resulting noise.

"Just Because Something Can be Hacked, Doesn't Mean It Will"

As the volume of vulnerabilities has escalated, organizations' methods for tracking, identifying, and remediating these issues have changed dramatically. The emphasis on prioritizing critical vulnerabilities has become paramount, requiring organizations to enhance their processes to minimize the number that necessitates immediate attention.

In 2021, the Cybersecurity and Infrastructure Security Agency (CISA) initiated the regular publication of its Known Exploited Vulnerabilities (KEV) list to help organizations prioritize patching based on actual threat activity. This resource has become increasingly valuable, with industry experts acknowledging its relevance amid the surge in reported vulnerabilities. Similarly, VulnCheck introduced its own KEV catalog in 2024.

Despite mounting pressures for backlog and remediation, many experts assert that the current vulnerability increase should not significantly burden security teams. Not every reported vulnerability translates to a real-world exploit.

According to Jeremiah Grossman, CEO of Root Evidence, attackers typically focus on the least defended assets, including those organizations may not even realize they possess. He cites a statistic indicating that only 1.4% of CVEs are actively exploited, further suggesting that organizations can refine this figure based on their specific environments, resulting in a more manageable subset of vulnerabilities.

While the number of potential vulnerabilities is on the rise, the actual rate of exploitation remains stable, indicating a downward trend, as Grossman elaborates.

"Organizations should concentrate on current adversary behaviors instead of hypothesizing potential threats," he advises.

AI Increases Volume but Not Risk

Concerns regarding AI's role in vulnerability management are prevalent, but with existing workloads already stretched thin, organizations can ill afford to be overwhelmed by this technology. Fortunately, current data suggests that AI is not significantly increasing vulnerability impact and volume.

"If AI identifies every vulnerability and is involved in every exploit and campaign, but breach volume and impact remain unchanged, then what does that signify?" questions Grossman.

Even though AI may contribute to rising volumes, sufficient data substantiates that organizations do not need to remediate every vulnerability identified, states Ed Bellis, CEO of Empirical Security. For those responsible for remediation efforts, the volume may represent additional noise, but methodologies exist that can effectively streamline this process.

"Many teams undertake this work manually, which exacerbates their difficulties," Bellis notes. "The scale of vulnerabilities we are dealing with today is beyond what people can manage effectively."

Jacobs concurs, highlighting that the lack of available data often necessitates manual processes. The published advisories provide only a minimal view of what organizations require for prioritization, compelling teams to exert extra effort to consult various resources, including blog posts.

Both Bellis and Jacobs foresee the evolution of effective programs to become increasingly data-driven, integrating expert opinions to refocus efforts and alleviate existing pressures. Consequently, the enhancement of data availability remains crucial; while improvements have been made, the pace is insufficient.

"Understanding the conditions that enable exploitation, alongside contextualizing these vulnerabilities, empowers discussions on compensating controls," Jacobs explains. "If a company already possesses specific controls, there may be numerous vulnerabilities they can deprioritize."

Air Your CVSS Grievances

The manner in which vendors disseminate advisories can sometimes appear more intimidating than necessary, largely due to reliance on subjective risk ratings. Organizations may encounter a bulletin highlighting a vulnerability with a critical common vulnerability scoring system (CVSS) rating of 10 and feel compelled to prioritize it immediately.

Frequently, organizations' assessments of what needs fixing are purely speculative and may overlook whether the vulnerability exists in their environment and the urgency of the threat. Grossman advocates for patch management programs to emphasize less on CVSS scores and more on the actual targets of adversaries.

"A CVSS 10 vulnerability in software that is not actively used is unlikely to attract adversaries," Grossman asserts.

Vendors often encourage their customers to prioritize disclosed vulnerabilities, potentially incentivizing inflated scores. Conversely, they may also aim for lower scores to avoid being perceived as companies harboring multiple high or critical vulnerabilities.

This duality can lead to conflicting messages.

"Depending on who in the company you engage with, their scoring priorities may differ," Grossman adds.

The CVSS and similar metrics are frequently "overprescribing," assigning alarmingly high scores to numerous flaws, Jacobs explains. As a result, security teams are experiencing fatigue from the sheer volume of vulnerabilities they are urged to address.

"Regardless of how you view it, the complexity persists," Bellis remarks. "This issue is particularly pronounced when relying on numerous expert opinions without supporting data."

Automation Helps Level the Scales

Certain vendors are making strides in simplifying the remediation of flaws within their products, Bellis points out. Some vulnerabilities can be patched in a matter of minutes, while others may take several months. For instance, he notes that Google Chrome issues typically feature automatic updates, whereas Microsoft updates may not be as straightforward, requiring more effort than Oracle or Java vulnerabilities, which necessitate comprehensive regression testing.

"Select a patch management tool that suits your needs," Bellis suggests. "The ability to automate vulnerability remediation is advantageous, but many vulnerabilities may not lend themselves to such methods."

David Lindner, CSO of Contrast Security, shares experiences indicating a similar trend. He frequently encounters clients using the platform to scan applications only to discover a CVE rated at 9.8 as critical, demanding remediation according to their vulnerability management protocols. However, these flaws are often rendered inaccessible due to existing controls designed to prevent their exploitation, Lindner adds.

"Mitigation serves as an alternative to remediation," Lindner explains to Dark Reading.

This observation leads him to believe the industry is transitioning toward a focus on risk management rather than pure vulnerability management. Many chief information security officers (CISOs) he has consulted report grappling with at least one million vulnerabilities across their organizations.

The scarcity of time and resources prevents many organizations from thoroughly examining subjective risk ratings to ascertain their actual impact. This reality has fostered a cycle in which organizations generate burn down charts, identify and remediate flaws, and subsequently report outcomes to boards. Lindner characterizes the prevailing mindset as one focused primarily on compliance rather than genuine risk mitigation.

Organizations must customize their vulnerability management programs by determining which tools—potentially AI-enhanced—best suit their needs, as well as which KEV lists or exploit prediction scoring systems align with their unique environments, Lindner advises. Standardized scores do not universally apply across organizations of differing sectors and sizes.

"It's subjective," he asserts. "This is not about adopting a single scoring system as the definitive guide; instead, it's about how it pertains to my specific context."