Your vulnerability management dashboard looks great. The backlog isn’t growing, thousands of findings were closed in the most recent month, and patch compliance is up. Somebody made some charts with lines going in the right direction, and everyone in the meeting nodded at it.
So I have a question: What does that chart tell you about your chances of a breach?
I’d argue it tells you very little. A team can close 3,000 vulnerabilities in a month and leave its most dangerous exposures sitting exactly where they were. The team did what the process asked. Yet, the business is still exposed to the attacks most likely to cost it money.
Looking under the streetlight
There’s the old joke about a man on his hands and knees under a streetlight late at night. Someone walks up and asks what he’s doing. He says he’s looking for his wallet. The guy helps him search for a while, finds nothing, and finally asks where exactly he lost it. The man points down the dark street at a city park. So why is he searching here? “Because this is where the light is.”
I think about that guy every time I see a vulnerability report from archaic vulnerability management companies. They count theoretical findings, track remediation rates, and celebrate shrinking backlogs because their platform lights those numbers up for us. Whether the work made the business any safer is somewhere in the park, and almost nobody walks over there to check.
Severity doesn’t tell the whole story
Consider two vulnerabilities. One has a CVSS score of 9.8 and sits on an internal system that almost nothing can reach. The other scores 6.5, but attackers have already used it in real attacks that resulted in a cyber insurance claim.
A team that sorts its queue by prioritization schemes that are heavily weighted using CVSS scores fixes the 9.8 first, and the 6.5 waits. The score was accurate, but the team fixed things in the wrong order.
CVSS measures technical severity. It was never designed to be relied upon to tell a CISO how likely a vulnerability is to lead to a breach or how much money the company could lose. There is even a section of the CVSS User Guide that says:
Base scores “are designed to measure the severity of a vulnerability and should not be used alone to assess risk.”
Fixing things in the right order requires evidence about verified exploitation and what real attacks have actually cost.
And yet most programs still rely on prioritization algorithms that are primarily based on these scores. Then teams work through the queue, close tickets, and report progress while not really knowing if true risk has been mitigated. In other words, everyone is busy looking for their wallet under the streetlight.
Measure what matters
No security team will ever have time to fix everything at once. What a team needs is a defensible way to decide what gets fixed first.
I’d start with two questions. Which vulnerabilities are attackers exploiting, and which ones have caused financial loss? Then I’d look at which of my systems are exposed to those attacks and what it would cost the business if one of them were compromised. That evidence sets the order of the work. After that, I’d measure the thing that matters most, whether we actually eliminated those exposures.
Reporting should follow the same logic. A CISO should be able to explain which risks the team removed (in dollar amounts, not just numbers of vulnerabilities), why those came first, and what significant exposure is still out there. A closure count can’t carry that story. Handing the board a closure count is like telling them how many square feet of sidewalk you searched under the streetlight.
This also gives executives a better way to judge security spending. They get to see what the team accomplished in risk removed, with ticket volume as a footnote. Our industry has gotten very good at finding theoretical problems. Proving that fixing the right ones will reduce financial risk is the future.
So the next time your team reports thousands of closed vulnerabilities, congratulate them, and then ask one more question:
“Did any of that work address the vulnerabilities most likely to cost us money?”
That’s the KPI of a vulnerability management program worth paying for. Everything else is a well-lit sidewalk.
(Root Evidence will be hosting a conversation between Co-founders Jeremiah Grossman and Robert Hansen on “Remediation: When and Why We Should Tackle Vulns?” tomorrow, Tuesday, October 27 at 8:00a PT. Reserve your seat today!)