- Exposure Management
- Predictive Prioritization
- Tenable Lumin
- Tenable Security Center
- Tenable Security Center Plus
- Tenable Vulnerability Management
What makes a vulnerability survive the remediation race?
What we found will help you improve your remediation processes and better prioritize vulnerabilities.
Why do vulnerabilities persist?
- In organizations that have remediated at least one instance of a vulnerability, nearly one-third of all detected vulnerabilities remain open after a year, and over one-quarter are never remediated. In fact, only 10 percent of organizations addressed all their open vulnerabilities within a year of first assessment.
- For vulnerabilities with exploits, despite a higher risk, the numbers remain roughly the same. This implies that defenders still operate as though all vulnerabilities have the same likelihood of exploitation. Threat intelligence and enhanced prioritization methods are necessary as current methods have shown to be insufficient to reduce risk.
- Only 5.5 percent of organizations have gained ground in their remediation race – vulnerabilities remediated exceeds those discovered during a given timeframe. This again points to the need for greater prioritization, as attaining 100-percent remediation is unsustainable for most organizations.
Download the Report:
Persistent Vulnerabilities
Their Causes and the Path Forward
What can be done?
With the volume of vulnerabilities disclosed, security teams must effectively prioritize vulnerabilities and assets to ensure they are effectively reducing risk and not misapplying limited resources. The results of this research indicate that traditional methods of prioritization at most organizations are insufficient to reduce risk. It is time for the industry to step up and begin providing security teams with data-driven tools and resources to drive effective remediation. Predictive Prioritization combines Tenable-collected vulnerability data with third-party vulnerability and threat data and analyzes them to identify the vulnerabilities with the highest likelihood of exploitation within the short term future.
- While many exploitable vulnerabilities are lagging behind in remediation, almost none of them go unremediated for over a year across the global population.
- Data-driven prioritization and threat intelligence are key to improving remediation practices and closing off avenues of attack across both IT and OT infrastructure.
- Organizations need better prioritization methods that incorporate components like threat intelligence and asset criticality.
