Vulnerable ≠ Exploitable: A Lesson on Prioritization
A large majority of all vulnerabilities are unexploitable. According to data compiled by Kenna, in 2020, only 2.7% of the vulnerabilities found appeared to be exploitable and only 0.4% of those vulnerabilities were actually observed to be exploited at all.
The prioritization of these low-risk or no-risk vulnerabilities alongside, or even above, the truly exploitable vulnerabilities can actually cause an organization’s security posture to suffer. It takes significant time and coordination to find the asset owners, bring them up to speed on the issue, prepare downtime for the asset, remediate the issue, and then confirm that the issue is remediated. Meanwhile, more critical vulnerabilities are waiting in line for their turn to be remediated.
Download this case study for more on how to further develop a risk prioritization strategy including:
- Continuous, autonomous pentesting;
- Determining business impact with total context and severity of the finding;
- How to identify exploitable attack paths.
