Vulnerability counts are the wrong number
In plain words: Counting every crack in the walls tells you little; what matters is the few cracks a burglar can actually reach on the rooms that matter most. Exposure and threat, explained simply
In short
- Most security dashboards report how many vulnerabilities are open. The number is large, it moves slowly, and it barely tracks risk.
- Only a small share of published vulnerabilities is ever exploited. The ones that are tend to sit on systems facing the internet, such as VPNs and other edge devices.
- Better numbers: how many known-exploited weaknesses are open on reachable, important systems, and how many days they stay open.
Why the count misleads
Tens of thousands of new vulnerabilities are published every year, and every large estate carries a backlog it will never clear. A count of open findings rewards closing easy ones on unimportant systems, and it hides the one critical, internet-facing flaw among thousands of low ones. It also goes up whenever a scanner is pointed at something new, which punishes the teams that look hardest.
Severity scores help less than people hope. A high CVSS score says how bad a flaw could be, not whether anyone is using it. FIRST's Exploit Prediction Scoring System, EPSS, estimates the probability that a vulnerability will be exploited in the next thirty days, and most scores are very low.
What attackers actually use
Verizon's 2025 Data Breach Investigations Report found exploitation of vulnerabilities was the initial way in for 20% of breaches, up by a third on the year before, with attacks on edge devices and VPNs prominent. CISA's Known Exploited Vulnerabilities catalogue lists the flaws with evidence of real-world use. It runs to well over a thousand entries, a small fraction of all published vulnerabilities. Under Binding Operational Directive 22-01, US federal agencies must fix catalogue entries by set deadlines, which is a working example of prioritising by exploitation rather than by count.
From counts to exposure
This is the idea behind continuous threat exposure management, which Gartner describes as a programme, not a tool: scope what matters, discover what is there, prioritise by what can really be exploited, validate that the attack path works, and mobilise the people who can fix it. The CTEM page on this site explains it and has a self-assessment.
My own view: three questions do most of the prioritising.
- Is it being exploited? In the KEV catalogue, or with a high EPSS score.
- Can an attacker reach it? Facing the internet, or one step from something that does.
- Does it matter? On a system that supports an important service or holds sensitive data.
A flaw that answers yes to all three is an emergency. One that answers no to all three can wait for the normal cycle.
Better numbers
- Open known-exploited vulnerabilities on internet-facing systems, by count and by age.
- Median days to fix a known-exploited vulnerability, compared with your own target.
- Share of important services with a tested attack path to sensitive data, and whether that share is falling.
What to do on Monday
- Match your open findings against the KEV catalogue and see how many are on systems reachable from the internet.
- Add EPSS scores and an "is it reachable" flag to the vulnerability report.
- Replace the headline count on the dashboard with the age of open known-exploited findings.
- Agree a short fix target for those, measured in days, and report against it.
Sources
- Verizon, 2025 Data Breach Investigations Report (2025).
- CISA, Known Exploited Vulnerabilities Catalog and BOD 22-01.
- FIRST, Exploit Prediction Scoring System (EPSS).
- Gartner's continuous threat exposure management, proposed in 2022, as the CTEM page on this site describes it.
Personal work and my own view, not my employer's. Sources are public.