Vulnerability Management Isn’t About the Score — It’s About How It Applies to You

Organizations need to move away from vendor-assigned, theoretical scores toward real exploit data specific to their environments.

Organizations are facing an impossible ordeal, tracking millions of vulnerabilities across hundreds of systems. Vulnerability management needs a revamp, but that doesn’t mean ditching prioritization and data-driven approaches. Organizations need to focus on what will affect them— there’s simply too many flaws now to do otherwise.

The crushing volume proved too much for one organization’s system, which collapsed following September’s Patch Tuesday release. Suddenly, the system couldn’t support the number of new vulnerability instances that were coming into their environment, reveals Empirical Security founder, Jay Jacobs. Though the numbers sounded manageable, fewer than 1,000 CVEs, they were spread across tens of millions of vulnerable assets.

And that company isn’t alone. Patch Tuesdays continue to break record numbers and include fixes deemed an emergency. Plus, automated tools and artificial intelligence (AI) are finding more flaws, setting off strings of alerts. Challenges are rippling across the industry as security teams race to quell the noise.

“Just Because Something Can be Hacked, Doesn’t Mean It Will”

How organizations track, identify, and remediate vulnerabilities has evolved significantly as the volume exploded. Prioritizing the most critical became key, but organizations needed better ways to reduce the amount that actually required attention.

In 2021, the Cybersecurity and Infrastructure Security Agency (CISA) started regularly publishing its Known Exploited Vulnerabilities (KEV) list to provide a way for organizations to prioritize patching based on real-time threat activity. Organizations continually rely on it, and experts agree it remains helpful despite the huge vulnerability uptick. Similarly, VulnCheck launched its own KEV catalog in 2024, and attributed the release to prioritization challenges.

Now, backlog and remediation pressures are mounting. However, many experts agree that the increase shouldn’t add to security teams workloads as much as advertised. Just because a vulnerability is reported doesn’t mean it will be exploited.

Attackers target the least defended assets, the ones organizations don’t even know they own, explains Root Evidence CEO, Jeremiah Grossman. Root Evidence found that only 1.4% of CVEs are exploited and then organizations can further break it down by which ones affect their personal environments. That creates a much smaller set which most organizations have the capacity to handle.

The number of possible vulnerabilities keeps rising, but the number adversaries actually exploit has stayed flat, so the exploitation rate is going down, Grossman tells Dark Reading.

“Companies need to focus on what adversaries are actually doing, rather than guessing at what they might do,” he says.

AI Increases Volume but Not Risk

AI is fueling fears around vulnerability management, but with attention already spread thin, organizations can’t afford to get bogged down by it. And they don’t have to. Root Evidence hasn’t seen data that AI will spike vulnerability impact and volume.

“Let’s say AI finds every vulnerability, is behind every exploit, is behind every campaign,” Grossman poses. “Let’s just say that happens, but the breach volume and impact stay constant. Is that then a great big AI so-what?”

Even if AI is adding to the volume, there is enough data and evidence to support the fact that organizations don’t need to fix every vulnerability out there, explains Empirical Security CEO Ed Bellis. For the people who handle remediations, it may be more noise, but they can still find ways to sort through it.

“A lot of teams are doing it manually, and that’s why they’re suffering,” Bellis tells Dark Reading. “The volumes we’re talking about now, people don’t scale to that.”

Insufficient data availability is the reason processes are so manual, adds Jacobs. The records and advisories being published only scratch the surface of what organizations need to prioritize, and that forces teams to put in extra efforts to find and read blog posts.

Bellis and Jacobs anticipate that effective programs will evolve to become more data-driven and take expert opinion into account, to shift focus and alleviate the pressure. That’s why adequate data availability is so essential; it’s improved, but not fast enough.

“If we can understand the conditions under which something is exploitable, and you’ve got the contact where these vulnerabilities are, now you can start talking about compensating controls,” Jacobs explains. “If a company already has a set of controls out there, there might be a whole bunch of vulnerabilities they can deprioritize.”

Air Your CVSS Grievances

The way vendors publish advisories can also look more daunting than necessary because they are based on subjective risk ratings. Companies may see a bulletin, warning of a vulnerability that received a critical common vulnerability scoring system (CVSS) rating of 10 and rush to prioritize it.

Many times, organizations are just guessing what needs to be fixed, versus whether it’s present in their environment and how imminent the threat is. Grossman recommends patch management programs focus less on CVSS scores and more on what attackers target.

“It could be a CVSS 10 in a software that nobody runs. Adversaries aren’t going to spend time doing that,” Grossman says.

Vendors want to ensure their customers prioritize their disclosed vulnerabilities over others — and that may incentivize them to score those vulnerabilities higher, Jacobs explains. On the other hand, they’re also incentivized to keep them lower because they don’t want to gain a reputation of being a company with millions of high or critical flaws, he adds.

That juxtaposition can lead to some mixed messages.

“Depending on who at the company you’re talking to, they themselves may have different priorities of how they’re going to score them,” Grossman adds.

CVSS and other similar metrics are “overprescribing,” giving many flaws high and critical scores, explains Jacobs. Security teams are burnt out by all the vulnerabilities they’re told to go after now.

“It’s complex either way you look at it,” Bellis says. “Especially when you involve a lot of expert opinions without data to back it up.”

Automation Helps Level the Scales

Certain vendors do make it easier for customers to fix flaws in their products, Bellis adds. Some flaws take one minute to patch, and others could take up to six months, he says. He noted Google Chrome issues auto updates, and while Microsoft may not be a point-and-click fix, it’s easier than Oracle or Java vulnerabilities, which require full regression testing.

“Pick your patch management tool of choice,” Bellis recommends. “The fact that you can automate the fixing of that vulnerability goes a long way, but there’s still a ton of vulnerabilities where that doesn’t even apply.”

David Lindner, CSO of Contrast Security, had similar stories to share. He hears “all the time” that customers will use the platform to scan their applications, find a CVE that’s 9.8 critical, and demand a fix per the vulnerability management program guidelines. But the flaw is often unreachable because controls are already in place to prevent it from being exploited, Lindner adds.

“That’s mitigation, just as fixing it is,” Lindner tells Dark Reading.

That’s why he believes the industry is shifting from vulnerability management to a risk management standpoint. Many chief information security officers (CISOs) he’s spoken to report facing at least one million vulnerabilities in their organizations’ environment.

Many organizations don’t have the time or resources to delve into subjective risk ratings to determine how much it actually affects them. That’s led to a cycle where organizations create a burn down chart, find and fix flaws, and then report it to boards, explains Lindner. The mindset is “it’ll be good enough for compliance and regulatory means,” he adds.

Organizations need to personalize their programs by figuring out which tooling, maybe AI-enabled, and which KEV lists or exploit prediction scoring systems work best in their environments, Lindner recommends. Universal scores don’t apply the same way across organizations of different sectors and sizes.

“It’s subjective,” he adds. “It’s not a ‘right now we’re using this as the gospel of vulnerability’ scoring systems, and whatever it says. It’s: How it applies to me.”