Discovery Has Scaled. Remediation Hasn’t: Top Takeaways on Threat Exposure Analytics

A few months ago a CISO said something to me that I keep thinking about. He said, if a product is just going to show him more vulnerabilities, he wasn’t interested. His team already had enough in their backlog. So his question to every vendor with an agentic AI pentesting solution was: Does it tell us where to focus first?

He’s not alone. In fact, this is the state of the industry today, as AI makes it cheaper and faster to find vulnerabilities. That’s why threat exposure analytics is key. Teams need to be able to turn their backlogs into prioritized lists of what to fix first. That was the overarching idea behind my Dark Reading webinar this week that co-hosted with Roselle Safran, CEO and founder of KeyCaliber. Here are the top takeaways from our conversation.

1. Severity Scores Can’t Sort a Growing Backlog

Security teams are already falling behind on the vulnerabilities that matter most. According to Verizon’s 2026 DBIR, the median time to remediate critical vulnerabilities rose by 11 days, to 43 from 32 the year before. And AI will only widen that gap. Anthropic publishes a disclosure dashboard for bugs found by Claude Mythos Preview and its other models in open-source software. As of October 2, it showed 29,439 findings. Of the 6,123 sent to outside security firms, 5,674 were confirmed valid, a true positive rate of roughly 93%. These findings are real, so filtering out false positives won’t shrink the list.

The only workable response is ranking real findings by the risk they pose to your business. While CVSS and vendor scores provide some insight, they don’t convey whether the asset is reachable, whether attackers are exploiting the flaw today, or whether the system supports a critical business process. As volume grows, more findings land in the same critical or high bucket.

Severity-only SLAs also leave a blind spot at the other end. One new customer I worked with ran their vulnerability management program on CVSS alone, with SLAs only for criticals and highs, because that backlog consumed every available hour. Mediums and lows had no clock at all. The next section shows why that’s risky.

2. Risk Lives in the Combinations

Exposure covers more than vulnerabilities. It includes misconfigurations, overprivileged identities (human or not), weak or leaked credentials, overshared data, internet-facing assets, third-party access, security coverage gaps, and shadow IT and shadow AI. Most of those never receive a CVE, so a scanner-only view will miss them. Finding unknown assets and gaps is where attack surface management earns its place.

Attackers know how to chain several of these exposures together to gain access. In a recent Exploits Explained post, a Synack Red Team researcher found a stored HTML injection in an internal web app, which most teams would rate low or medium. He also found that an ordinary domain user could add a DNS record, that Windows silently sends credentials to hosts it believes are on the intranet, and that Active Directory Certificate Services accepted the relayed credential in its default configuration. Only the first link would show up in a scanner. The other three were design choices and defaults. Chained together, they gave him DCSync privileges, which is effectively the keys to the domain.

Once you map attack paths and validate which ones reach critical systems, look for choke points, where one fix cuts several paths at once. The question changes from “Is this asset vulnerable?” to “Can this be used to reach something that matters to the business?”

3. Context Sets the Clock

Risk is likelihood times impact. To find likelihood, look at the security context, like exploitability (KEV, EPSS), reachability, accessibility from the next hop, the defenses in place, current threat intelligence, and what has already happened in your environment. Business context supplies the impact.

CISA has put part of this into a mandate. Binding Operational Directive 26-04, released in June, sets remediation deadlines for federal civilian agencies using four signals: whether the vulnerability is publicly exposed, whether it’s on the KEV catalog, whether exploitation can be automated, and what the technical impact is. The more signals a vulnerability hits, the shorter the deadline. A vulnerability that hits all four carries a three-day deadline. The lowest-risk ones can wait for the next scheduled upgrade. CISA cited AI’s effect on vulnerability volume and attacker speed as part of the reasoning.

Penetration testing puts you ahead of the mandate, because it shows evidence of real-world risk instead of how scary a CVE looks on paper. That’s the idea behind continuous threat exposure management, and it’s why we built the Synack and Wiz integration to feed validated pentest findings into exposure management workflows.

4. Scope Around the Business Process, Not the Asset

Business context starts with the Minimum Viable Organization (MVO): the smallest set of infrastructure and operations needed to keep serving customers. It begins with a critical business process, which breaks down into critical applications composed of critical assets and SaaS vendors.

The same model changes how you scope a pentest. Instead of scoping around the crown jewel (the URL of the app that drives revenue), cast a wider net to capture supporting APIs, databases, identity providers, third parties, and integrations around it. Everything that touches the process is a potential way in. If you scope the test the way you’d define your MVO, you test the whole ecosystem and learn the real risk.

5. Treat AI Prioritization as a First Draft

More teams use AI to correlate findings and score risk. Treat the output as a useful first draft and a risky final one. Remediation is a fixed resource, so a wrong call is expensive.

Picture a publicly exposed web server with several high CVSS findings. AI might rank it first, without knowing that existing controls already block access. Meanwhile, a medium-rated, overprivileged service account linked to that server could sink to the bottom of the list, even though of the two it’s the one that takes an attacker somewhere important. AI doesn’t fully understand your business context or your risk appetite. A human needs to review the ranking before remediation resources are committed. It’s the same reason we pair Sara AI Pentesting with human validation, and why turning scanner findings into validated risk matters so much.

6. Fix the Cause, Not the Ticket

Too many programs run like a treadmill: find, triage, ticket, fix, then find the same thing again. Four steps break the cycle. Pull findings from every silo into one place. Look for patterns by cause, vulnerability class, component, team, or pipeline. Fix upstream, whether that’s secure defaults, a shared library, a pipeline check, or training. Then measure recurrence to confirm the fix holds. Six injection flaws in six apps is a prompt to look at a shared library or development pattern, not to open six tickets. Continuous penetration testing is a good way to check that a fix held.

Remediation also covers more than patching. It can mean reconfiguring, adding guardrails around what an AI agent can reach, closing coverage gaps, layering compensating controls where you can’t patch, or shrinking an identity’s access. When the fix belongs to IT, networking, or cloud teams, a quantified business case is what puts it on their list.

7. Report Progress, Not Activity

Leadership wants to know whether risk is better or worse than last quarter. A few changes make that conversation easier:

• Show trends, not siloed totals. Report a single view of organizational risk and the change since the last review.
• Pair MTTR with half-life. MTTR only counts what was fixed, so the old, hard findings fall out of view. Half-life measures how long it takes to fix half your open vulnerabilities, which keeps the long tail visible. Add context such as how much of your attack surface you test and how often.
• Translate compliance. Reporting only a compliance status to a board is like asking a car salesman the price and hearing “medium.” Leadership thinks in financial terms, so connect the work to business value.
• Keep it simple. One picture, one number, one sentence. If you’ve found three validated paths to your MVO this quarter and fixed the choke point behind them, show that the number went to zero next quarter.

Before presenting, confirm leadership’s risk appetite, define what good looks like at 6 and 12 months, keep the red-yellow-green coding consistent, and leave technical detail out of the room.

Where to Start

Begin with leadership’s buy-in on risk appetite, then add security and business context to everything you prioritize. Start small instead of trying to boil the ocean, and keep iterating.

With NetSPI and Synack officially merged, we help security leaders validate what’s exploitable across the whole attack surface through our AI and human-powered platform, so the prioritized list you hand to engineering is built on evidence. If you’re dealing with a backlog you can’t fix, Sara AI Pentesting is a good place to see what a validated, human-reviewed finding looks like. Start a free trial, or watch the webinar.

Related reading: What I Told Security Leaders at Gartner SRM 2026 • Build vs. Buy AI Pentesting: Why Dow Chose to Partner With Synack • Unifying Security Testing and Exposure Management: Introducing the Synack and Wiz Integration