A Single Partner for Everything You Need With more than 450 technology partners in its ecosystem, Optiv provides clients with best-in-class security technology and solutions that equip organizations to detect and manage cyber threats effectively and efficiently in today's growing attack surface. Optiv's Partner of the Year Awards recognize forward-thinking innovation, performance and growth, and unparalleled technology solutions.
We Are Optiv Security Greatness is every team working toward a common goal. Winning in spite of cyber threats and overcoming challenges in spite of them. It’s building for a future that only you can create or simply coming home in time for dinner. However you define greatness, Optiv is in your corner. We manage cyber risk so you can secure your full potential.
Vulnerability Management Is Now a Detection and Response Problem Breadcrumb Home Insights Blog Vulnerability Management Is Now a Detection and Response Problem October 23, 2026 Vulnerability management has always been a security program that operates a bit differently than other security operations. Compared to detection and response work, vulnerability management programs were treated as real, but not every finding was a threat, and there was no real way to actually tune what your team needed to remediate. This forced a compromise, where many organizations made a reasonable tradeoff between security and workload, and created patching schedules and cadences. This paradigm, combined with concerns about access and downtime, led to vulnerability management becoming a checklist for most organizations. The risk of a fully chained exploit was not high, so defense-in-depth was a better use of resources. Combined with environments that changed slowly and could be centrally managed, this mostly worked. This is not the case anymore. The risk of unpatched or unremedied vulnerabilities or misconfigurations is far greater. This began with the push to public cloud and took off when DevOps became the name of the game. There were mitigations and ways to manage the risk, if only because the risk of an actual vulnerability or misconfiguration being exploited was quite low. However, the real danger has now become AI-assisted attacks, using exploits and misconfigurations to chain and gain access. Automation on the attacker side has always been able to do this, but wide-scale attacks were fairly rare, and “low-hanging fruit” was the primary target. Unfortunately, the days where you can assume attackers are too slow or focused elsewhere are over. At this point, it's about what detection and response engineers have been dealing with for years: How do you prioritize and mitigate risks that are actual problems, while lessening the need to solve every problem at once? Vulnerability management has effectively become a detection and response problem. The Finding Is Not the Risk A vulnerability record describes a weakness, but it’s not, by itself, an actual threat to your environment. Vulnerabilities are everywhere. Some of them are outdated code, others are admin access on a laptop that doesn’t need it. Vulnerability scanners, CSPM, CNAPP and various pen test tools create findings, but this doesn’t necessarily mean that there is actually a path for an attacker or controls in place to stop them. These concerns require context outside many scanners or programs that teams rely on today. Attackers aren’t just going down a list and throwing exploits. They’re finding ones they know can be chained together and then approaching the attack like a chain. They find multiple vulnerabilities and misconfigurations, combined with credentials obtained from data leaks or elsewhere, to figure out ways into an environment. There’s never been a great way to replicate this internally without running expensive tests to validate findings, and usually, was only done for the most serious of vulnerabilities. Even so, it often wasn’t done in the same manner as attackers at all, instead looking for TTPs or IOCs that signified the ability to have completed kill chains. Thus, existing vulnerability management programs are ill-prepared for the current world. Just because there is a critical vulnerability on a spreadsheet doesn’t mean that it’s your highest priority. In fact, several low priorities that would traditionally be patched quarterly may actually be the risk you need to prioritize. Detection and response teams discovered this issue a long time ago, with low severity detections as a needle in the attacker’s haystack. Why Continuous Validation The word continuous is often reduced to scan frequency. More frequent discovery is useful, but it does not create continuous exposure management on its own. A mature program repeatedly answers a harder set of questions: What changed? Which change altered an attack path? What can be exploited now? Who needs to act? Did the action remove the exposure? Continuous threat exposure management (CTEM) is the framework trying to address this new environment. CTEM is a slight change in terms of conversation; it sounds easy. You go from vulnerability management to continuous threat exposure management. However, that change belies a much larger and systemic change for how teams must treat their vulnerability management programs. You are not only continuously discovering risk, but also continuously remediating, mitigating and finally verifying the removal of that risk. This is incredibly difficult, for problems we already covered above. Knowing that the volume of vulnerabilities outpaces our ability to solve them, how is the modern security team expected to implement something close to a CTEM framework? In Optiv’s opinion, this is done via prioritization based upon attackers' ability and a validation methodology that allows teams to focus on doing the work, not just assessing it. This turns validation into a feedback mechanism rather than another source of alerts. The 3 Roles of Validation Continuous validation adds the most value when it is tied to decisions, not just used to generate more proof-of-concept results. Validation should do three things: Establish exploitability. Determine whether an exposure can be reached and used under the environmental conditions that exist, rather than relying on theoretical severity alone Test the path and the controls around it. Show how multiple conditions connect and where preventive or detective controls stop, slow or miss the activity Verify closure. Retest after remediation to confirm the exploitable condition or path is gone These jobs produce different forms of evidence. Exploitability evidence improves prioritization, attack-path evidence helps teams choose the remediation that will break the chain and closure evidence demonstrates that the work changed the organization’s exposure, not ticket status. This evidence, taken together, allows teams to do something new in the vulnerability management space. This operating model allows teams to begin treating and mitigating their most critical risks on a continuous basis, then going after and mitigating the risks left behind. By prioritizing the misconfigurations or vulnerabilities that are the largest contributors to risk, attackers will have a much harder time chaining vulnerabilities together. According to Cyentia, only about 2% of CVEs are exploited, and these often sat on choke points. Not every vulnerability is equal, and the ones attackers can chain are going to be more impactful to overall security, not necessarily ones with the highest CVSS score. Solving for those, then mitigating smaller vulnerabilities that can be used to escalate threats later, is the entire concept of continuous validation. Run Exposure Management Like a SOC CTEM has five stages: scoping, discovery, prioritization, validation and mobilization. If you’ve worked in detection and response, that list should look familiar. A security operations center (SOC) triages alerts, tunes out noise, hands real incidents to the people who can act on them and confirms the threat is gone before closing a case. Exposure management needs to work the same way. Validation is the triage step. It answers whether a finding can actually be reached and exploited in your environment. Attack-path prioritization does the same job that tuning does in a SOC, separating the exposures that lead somewhere from the ones that dead-end. Mobilization is the escalation: getting the fix to the team that owns the system. That fix often isn’t a patch. It might be a configuration change, a removed permission or a rotated credential. Retesting closes the case, and it’s the step that gets dropped when teams are stretched. These stages have to stay connected. A validated attack path doesn’t reduce risk until it reaches the team that owns the fix, and that fix doesn’t count until a retest confirms the path is closed. What Changes for Security Leaders Instead of... Ask... “How many critical vulnerabilities are open?” “Which validated paths can reach the business services we care about most?” “Did the remediation ticket close?” “Did retesting confirm the path is no longer exploitable?” “Are we scanning often enough?” “Can we detect and validate material changes before they become durable exposure?” Questions like these create a clearer line from technical work to risk reduction. They also reveal where the program is constrained, such as from incomplete asset context, slow ownership decisions, limited testing capacity, remediation friction or a lack of verification after changes are made. Managed Exposure Validation: From Activity to EvidenceMost organizations have some of the pieces already: scanners, a testing tool, a ticketing system. What they usually lack is the capacity to run the full cycle week after week. Someone must scope tests safely, read the results in context, get fixes to the right owners and retest once the work is done. Attackers have automated the chaining part. Defenders need to be able to do the same on a regular basis, and most teams don’t have the staff to do it on their own. Optiv’s managed exposure validation (MEV) service pairs Horizon3’s exposure validation platform with Optiv-led vulnerability operations. Horizon3 tests your environment by chaining vulnerabilities, misconfigurations and credentials together, showing what an attacker can actually reach. Optiv analysts take those validated paths, work out which fixes break the most chains and route them to the teams that own the systems. Once a fix is in, it gets retested, so you can show leadership that exposure went down. Reach out today to see how Optiv experts can help your organization stay ahead of threats. By: Ben Spencer Product Director Ben Spencer is a product director at Optiv with over 10 years of experience in IT and cybersecurity. He specializes in detection and response, incident response and threat intelligence, helping organizations modernize security operations and improve resilience. Ben works closely with internal and external stakeholders while leading teams focused on advancing Optiv’s managed security services and delivering measurable value to clients. Share: Optiv Vulnerability Management threat exposure management exposure validation exposure management About Optiv Security: Secure greatness.® Optiv is the world’s largest pure-play cybersecurity company. With unmatched technology partnerships and deep technical expertise, Optiv securely enables the AI era for more than 6,000 clients. From financial services and health care, to government, energy and retail, organizations trust Optiv to advise, deploy and operate cybersecurity programs that reduce risk and deliver real results. Learn why Optiv is the most trusted brand in cyber at optiv.com.
About Optiv Security: Secure greatness.® Optiv is the world’s largest pure-play cybersecurity company. With unmatched technology partnerships and deep technical expertise, Optiv securely enables the AI era for more than 6,000 clients. From financial services and health care, to government, energy and retail, organizations trust Optiv to advise, deploy and operate cybersecurity programs that reduce risk and deliver real results. Learn why Optiv is the most trusted brand in cyber at optiv.com.