A routine security assessment at a 300-person B2B organization uncovered an internet-accessible database with inadequate authentication protections. The flaw carried critical severity and seemed like an obvious remediation target. Yet deeper investigation revealed the database served only as a sandbox for evaluating job applicants, containing no production or customer information. The discovery illustrates a fundamental challenge facing modern security operations: automated scanners cannot distinguish between genuine threats and false alarms without understanding what systems actually matter to the business.
The underlying problem extends beyond this single case. Security teams increasingly struggle under the weight of excessive alert volume. Scanners generate findings faster than teams can evaluate them, forcing engineers to sift through noise while managing competing demands—feature development, customer support, infrastructure scaling, and the overhead of supervising AI systems. Simultaneously, security programs ingest data from identity systems, network firewalls, endpoint sensors, and threat feeds, each producing more signals than years past. Every alert appears urgent and high-risk, yet resources remain finite.
Jon Rose, founder of IOmergent, an information security and risk management advisory firm, has observed firsthand how widespread tooling and AI capabilities are generating more findings than security teams can handle. "Within the span of security work, there's an unending list of things you could tackle, and you're pulled in so many different directions," Rose explains. "But you have to be ruthless about prioritizing and investing your time." The real challenge is not fixing vulnerabilities—it is deciding where constrained engineering and security capacity will deliver the greatest value. A numerical severity rating, divorced from threat context and environmental factors, cannot answer the business question that matters most: what deserves attention first?
CVSS Provides Foundation, Not Final Answer
The Common Vulnerability Scoring System offers security teams a standardized baseline for assessing flaws. Its base metrics evaluate attack vector, attack complexity, privilege requirements, and potential harm to confidentiality, integrity, and availability. However, base scores are designed to remain consistent across different environments, which means they cannot reveal whether an asset faces internet exposure, benefits from compensating controls, or represents a critical business function.
Treating a base severity score as an automatic trigger for immediate remediation creates problems. CVSS does support Threat and Environmental metrics that incorporate evolving exploit conditions and organization-specific circumstances. Yet risk-based vulnerability management still requires precise environmental knowledge and consistent application of that context across the organization. "The piece that's missing from any of these tools is the grounding in the business, the understanding of what actually matters," Rose observes.
Reachability and Business Impact Drive Real Prioritization
A sound prioritization framework shifts focus away from raw severity scores toward a practical question: can an attacker actually reach the vulnerable component? "Is the affected service exposed to the public internet or not? Or is it isolated behind network controls and accessible only to a limited set of internal users?" Rose asks. "Often, issues will get flagged, but it's not in a position where it could be triggered."
Beyond reachability comes consequence. A critical flaw in a disposable test environment represents a legitimate security concern but carries far less weight than the same flaw in systems processing customer payments, storing sensitive data, or generating primary revenue. A high-severity finding may warrant less urgency if it cannot be accessed, poses limited damage, and sits behind reliable defensive measures.
Teams should also evaluate whether attackers are actively exploiting the weakness and what downstream impact it could enable. Vulnerabilities appearing in CISA's Known Exploited Vulnerabilities catalog merit immediate attention due to documented real-world exploitation. The Exploit Prediction Scoring System offers another signal—an estimate of the probability that a particular flaw will be exploited within the next 30 days. Neither tool replaces business judgment, but both help separate theoretical risks from those demanding urgent action. As AI-driven exploitation becomes faster and cheaper, the interval between vulnerability discovery and active weaponization continues to shrink.
Attack chains may extend beyond a single vulnerable system. A seemingly minor flaw gains immediate priority if it provides entry to privileged accounts, production infrastructure, or customer records. Conversely, a high-severity finding can be temporarily deprioritized when it lacks network access, carries limited consequences, and remains protected by effective controls. "The speed and the depth of research and investigation into those security issues are going faster," Rose notes. "So it can change really quickly."
The worst scenario occurs when acknowledged risk languishes unaddressed in the backlog. Even sophisticated detection systems degrade when no one monitors trends. Teams should document exceptions, schedule review dates, and assign clear ownership. Accepted risk remains risk; the distinction lies in making that acceptance explicit, time-limited, and subject to periodic reassessment.
Operationalizing Business-Aware Prioritization
Security teams increasingly rely on AI to triage and prioritize threats while simultaneously discovering vulnerabilities at record volume. Yet the sheer quantity of findings overwhelms even highly efficient teams. Research examining over 20,000 issues remediated by AI found that large language models introduce nearly 9 times as many new vulnerabilities as human developers, with patterns distinct from those in developer-written code. The solution involves applying AI at the outcome level—ensuring that for each alert, security operations center analysts obtain rapid answers to standard questions: Is this new or previously known? What systems are exposed? What data faces risk? Does this affect production or development? How has the situation evolved?
"That's how teams get thousands of alerts down to 10 to 20 prioritized tickets," Rose tells The New Stack. "Effective programs start by aligning with executive teams to understand the business — where the company is going — so allocation and adjustments track the actual risk, not just the score."
As workloads expand and backlogs grow, the daily application of business-informed judgment by someone accountable for outcomes deserves dedicated resources and organizational investment.
Source: The New Stack