The Security Metric That Lies: Why Knowing Your Vulnerabilities Is Not the Same as Reducing Your Risk
Security teams are drowning in vulnerability reports yet still cannot answer the one question that matters: are we actually harder to attack today than we were last year? A growing number of experts say the old way of measuring risk is the problem.
Key points
- Most organisations already have more security findings than their teams can realistically fix, yet overall risk is not reliably falling.
- Severity scores, the standard way of ranking which flaws to fix first, measure a flaw's characteristics, not whether a criminal can actually use it to cause harm.
- Gartner's Continuous Threat Exposure Management (CTEM) framework, a structured approach for evaluating what attackers can realistically reach and exploit, has gained wide adoption as an alternative lens.
- Exposure is broader than any single flaw: it includes identities, permissions, and the relationships between systems that let criminals move from a minor breach to a catastrophic one.
- The question shifting boardroom conversations from "how many vulnerabilities did we find?" to "what can an attacker actually reach?"
For most of the past two decades, the core promise of cybersecurity was simple: find the weaknesses in your systems, rank them by severity, patch the worst ones first, repeat. It worked well enough when company networks were small and changed slowly. It is struggling now.
Why the old approach is breaking down
The problem is not that security teams have stopped looking. They are finding more flaws than ever. The problem is that finding a flaw and reducing the risk it creates are two different things, and the industry spent years treating them as the same.
Traditional tools assign each flaw a severity score, a number meant to signal how dangerous a weakness is. A score of 9.8 out of 10 sounds alarming. A score of 4.2 sounds manageable. But severity scores describe the flaw in isolation. They do not describe what a criminal can do with it inside your specific environment.
A critical flaw buried deep in a system no outsider can reach may pose almost no real danger. A moderate flaw on a system that also has weak passwords and overly broad permissions, meaning settings that give users more access than their job requires, can hand a criminal the keys to your most sensitive data. Severity is not risk.
How criminals actually attack
Criminals do not pick one vulnerability and stop there. They chain weaknesses together. They break into a low-value system, use lax permissions to move sideways across the network (a technique called lateral movement), and escalate their access until they reach something worth stealing or encrypting for ransom.
The vulnerability that opened the door matters less than the series of conditions that let the criminal walk all the way to the safe.
This is the core idea behind a framework called Continuous Threat Exposure Management, or CTEM, developed by the research firm Gartner. Rather than cataloguing every flaw individually, CTEM asks organisations to map the realistic paths a criminal could take through their environment and focus remediation on breaking those paths.
What 'exposure' means in plain English
Exposure is a wider concept than vulnerability. It covers the combination of flaws, weak identity controls (meaning who is allowed to log in and from where), excessive permissions, trust relationships between systems, and the value of the data sitting at the end of each possible attack path.
A single flaw is rarely the whole story. Two minor issues that overlap can create a direct route to critical infrastructure. That is exposure. And exposure determines impact, not the severity score on any individual finding.
| Concept | What it measures | Limitation |
|---|---|---|
| Severity score | How dangerous a flaw looks in isolation | Ignores your actual environment |
| Vulnerability count | How many flaws were found | Says nothing about exploitability |
| Exposure | What attackers can realistically reach and do | Requires broader data to calculate |
| CTEM | Continuous mapping of realistic attack paths | Newer; needs tooling and process change |
What this means for ordinary people
If you are a customer, a patient, or an employee of any large organisation, this shift matters to you. Breaches that expose personal records almost never happen because one flaw went unpatched. They happen because a string of overlooked conditions created an open road to sensitive data.
Organisations that move from counting vulnerabilities to measuring exposure are asking a harder question, but the right one: not "what is broken?" but "what can a criminal do with what is broken?"
If your employer or a company that holds your data asks you to follow security hygiene steps, such as using strong unique passwords or reporting suspicious emails, those small actions close off parts of that road. They reduce exposure even when the underlying software flaw has not yet been patched.
