Vulnerability Management Isn't About the Score, It's About How It Applies to You
Dark Reading, Thursday, October 15th, 2026
Experts urge moving from vendor severity scores to real exploit data and environmental context as CVE volumes explode.
Record Patch Tuesdays and AI-driven discovery are overwhelming vulnerability programs, and one organization's system collapsed after September's release because fewer than 1,000 CVEs spread across tens of millions of assets.
Root Evidence's Jeremiah Grossman says only 1.4% of CVEs are exploited and the number adversaries actually exploit has stayed flat.
Empirical Security's Ed Bellis and Jay Jacobs say teams suffer because they prioritize manually with thin data.
The experts recommend KEV catalogs, exploit evidence and environment-specific context over theoretical scores.