Organizations are facing an impossible ordeal, tracking millions of vulnerabilities across hundreds of systems. Vulnerability management needs a revamp, but that doesn't mean ditching prioritization and data-driven approaches. Organizations need to focus on what will affect them— there's simply too many flaws now to do otherwise.
The crushing volume proved too much for one organization's system, which collapsed following September's Patch Tuesday release. Suddenly, the system couldn't support the number of new vulnerability instances that were coming into their environment, reveals Empirical Security founder, Jay Jacobs. Though the numbers sounded manageable, fewer than 1,000 CVEs, they were spread across tens of millions of vulnerable assets.
And that company isn't alone. Patch Tuesdays continue to break record numbers and include fixes deemed an emergency. Plus, automated tools and artificial intelligence (AI) are finding more flaws, setting off strings of alerts. Challenges are rippling across the industry as security teams race to quell the noise.
"Just Because Something Can be Hacked, Doesn't Mean It Will"
How organizations track, identify, and remediate vulnerabilities has evolved significantly as the volume exploded. Prioritizing the most critical became key, but organizations needed better ways to reduce the amount that actually required attention.
In 2021, the Cybersecurity and Infrastructure Security Agency (CISA) started regularly publishing its Known Exploited Vulnerabilities (KEV) list to provide a way for organizations to prioritize patching based on real-time threat activity. Organizations continually rely on it, and experts agree it remains helpful despite the huge vulnerability uptick. Similarly, VulnCheck launched its own KEV catalog in 2024, and attributed the release to prioritization challenges.
Now, backlog and remediation pressures are mounting. However, many experts agree that the increase shouldn't add to security teams workloads as much as advertised. Just because a vulnerability is reported doesn't mean it will be exploited.
Attackers target the least defended assets, the ones organizations don't even know they own, explains Root Evidence CEO, Jeremiah Grossman. Root Evidence found that only 1.4% of CVEs are exploited and then organizations can further break it down by which ones affect their personal environments. That creates a much smaller set which most organizations have the capacity to handle.