Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How CISOs Prioritize Vulnerabilities with Exposure Management
Transcript
- Lucas: So Luna, we talk a lot about breaches and defenses, but let's get into the messy middle: how CISOs actually decide which vulnerabilities to fix first when there are simply too many. Luna: I've heard the phrase 'the patch queue is the new inbox' — is it that bad? Lucas: Worse, actually. The average large enterprise has somewhere between fifty and a hundred thousand open vulnerabilities at any one time. And the typical team can only remediate maybe five to ten percent of those in a given month. So the question isn't 'how do we fix everything', it's 'what do we fix first'. Luna: That's the exposure management playbook, right? Lucas: Exactly. Exposure management is the umbrella term that's been replacing the old vulnerability management approach. Instead of just cataloging weaknesses and slapping a severity score on each one, it tries to answer: which of these are actually exploitable, and which ones could actually hurt our business if they were exploited? Luna: So it's less about the score and more about the context. Lucas: Right. A critical-rated flaw in some internal tool that's two network hops away from the internet might be less urgent than a medium-rated issue on a public-facing edge device that's directly reachable. Attackers aren't scanning for the highest critical score; they're looking for the easiest path in. Luna: And that path often goes through some overlooked asset that nobody even remembers is there. Lucas: That's the classic shadow IT problem. A team spins up a quick server for a project and forgets to decommission it. That's often where the real exposures hide. Luna: So how do CISOs actually apply exposure management in practice? Is it a new tool, a new process? Lucas: It's a combination. You've got platforms that aggregate vulnerability data from scanners, cloud providers, endpoint agents — all into a single view. Then they layer on threat intelligence: is this vulnerability being actively exploited in the wild? Is there a known exploit kit? And then they add business context: what data is behind that asset, what's the compliance requirement, what's the blast radius if it gets popped? Luna: That's a lot of data to correlate. Lucas: It is, and that's why we're seeing these platforms get more sophisticated. Some are using machine learning to predict which vulnerabilities are most likely to be exploited, based on patterns from thousands of companies. It's not perfect, but it's way better than a human trying to eyeball a thousand CVEs a day. Luna: And the goal is to get to a shortlist that a human can actually review? Lucas: Exactly. The best programs have a triage process: automated scanning and enrichment, then a human analyst or small team focuses on the top fifty or hundred exposures a week. They validate, they check for mitigating controls, and they decide: patch now, or accept the risk for a while because the exposure is low. Luna: I've heard some CISOs talk about 'exploitability' as the new magic metric. What's that about? Lucas: It's basically a measure of how easy it is for an attacker to actually use a vulnerability. It factors in things like whether the vulnerability is in a widely used library, whether there's a public proof of concept, whether it requires user interaction or special privileges. A vulnerability that's trivial to exploit and has a public PoC is going to get prioritized way above something that requires physical access or a complex chain of events. Luna: That makes sense. And this is where threat intelligence feeds become critical. Lucas: Huge. We saw that in 2025 with the MOVEit-style supply chain incidents. Those were not the highest severity on paper, but once the exploit was public and ransomware groups started using it, exploitability shot up. CISOs who had good threat intel feeds were able to jump on that quickly, even before the official emergency directives came out. Luna: So it's about speed and context, not just the CVSS score. Lucas: Right. And I should say, the CVSS score is still part of the picture — it's just not the whole picture. Exposure management is about layering multiple signals to get a risk score that's actually actionable. Luna: And what about the 'fix the easy wins first' principle? I've seen that in some recommendations. Lucas: That's a good practical rule. If you can automate or script a patch that takes five minutes and covers a hundred systems, that's usually a better investment than spending a week on a complex migration for a single critical system. The math is simple: reduce the attacker's opportunities broadly, then focus on the high-value targets. Luna: And that's where automation comes in — not just for patching, but for validation. Lucas: Absolutely. You can have your scanner re-run after a patch to confirm it actually closed the vulnerability. We're seeing more platforms that integrate directly with ticketing systems and even auto-create and close tickets. It's about making the whole lifecycle as frictionless as possible. Luna: One thing that's always tripped me up: how do you handle vulnerabilities in third-party code that you don't control? Lucas: That's the supply chain problem. You can't patch a library that's embedded in a vendor's product. So you have to rely on the vendor's patch cadence, and in the meantime you apply compensating controls: network segmentation, stricter access rules, maybe a WAF rule to block known attack patterns. And you track that vendor's response like a hawk. Luna: And that's where the relationship with the vendor becomes strategic, not just transactional. Lucas: Exactly. CISOs are increasingly asking vendors about their security patch processes before even signing a contract. It's become a procurement criterion, not just a technical detail. Luna: So, if I'm a CISO listening to this, and I haven't yet moved to an exposure management approach, where do I start? Lucas: Start with an honest inventory. You can't manage exposure if you don't know what you have. There are plenty of tools now that can discover shadow IT — agents, network scans, cloud API integrations. Get that baseline, then start feeding in vulnerability data and threat intel. Even a manual spreadsheet based triage is better than nothing. Luna: And then the next step is to focus on the crown jewels, I guess. Lucas: Yeah, map your critical assets — the data and systems that would really hurt if they were compromised. Then you can prioritize vulnerabilities that affect those assets. It's a risk-based approach, not a 'fix everything by Tuesday' approach. Luna: It feels like a shift from firefighting to actually managing risk. Lucas: That's the goal. And the best CISOs are making this shift because they know that perfect security is impossible. What they can do is make sure that when a breach happens, it's not the one that was obvious and exploitable and sitting there for months. Luna: Right. And that's the message we try to get across every day on this show. By the way, if these conversations are useful for what you're building or running, you might want to know how we keep this thing going without ads. Lucas: Yeah, we get asked that a lot. The truth is, a handful of listeners chip in monthly through buy me a coffee dot com slash fexingo, and that's what funds the whole operation. It keeps us independent and ad-free. Luna: And we genuinely appreciate it. It's not a big pitch — it's just how we keep doing this. Lucas: So back to that CISO starting from scratch — once you have the inventory and the priorities, the next step is to build a cadence. Review the top exposures weekly, adjust the priorities based on new intel, and keep the automation humming. Luna: And what about the human element? Sounds like it's still crucial. Lucas: More than ever. The machines can triage, but the judgment calls — like 'do we take this critical system down for a patch during business hours or wait for the weekend' — that's a human decision. And that's where the CISO's leadership comes in. Luna: Makes sense. So exposure management is less about technology, more about mindset. Lucas: I'd say it's both, but the mindset is the part that's hard to buy. You have to convince the board and the business that you're managing risk, not eliminating it. And that's a conversation worth having.