The Problem
Your security team, using CrowdStrike, encountered a daunting challenge: 500,000 vulnerability findings flagged by the scanner. Each finding had a CVSS score demanding attention. Patching half a million issues is impractical, so the team focused on "critical" and "high" severity findings.
Praetorian Guard conducted an exploit chain analysis on the same data and found 14 endpoints where attackers could chain vulnerabilities to achieve full host compromise. The remaining 499,986 findings were noise. This wasn't a breach, but a near-miss that many organizations might overlook.
The Analysis Process
The analysis followed these steps:
- Initial Findings: CrowdStrike deployment identified 500,000 vulnerabilities.
- Traditional Triage: The team prioritized based on CVSS scores, focusing on "critical" and "high" severity items.
- Exploit Chain Analysis: Praetorian Guard mapped actual attack paths.
- Outcome: 14 endpoints were identified where chained exploits could lead to full compromise.
The gap between "500,000 findings" and "14 that matter" highlights the failure of treating vulnerabilities as isolated events instead of parts of attack paths.
Missing Controls
Inadequate Risk Assessment
Relying solely on CVSS scores for risk prioritization is insufficient. CVSS evaluates vulnerabilities individually, missing how attackers can chain them to exploit systems. A CVSS 4.3 vulnerability can become critical if it links to an exposed service.
Lack of Attack Surface Mapping
Your team needs to map how vulnerabilities connect across the environment. Without understanding:
- Reachable systems from an initial foothold
- Privilege escalation paths
- Vulnerability combinations forming attack chains
You're essentially patching blindly.
Absent Threat Modeling
Vulnerability management should integrate with threat modeling. Ask, "If an attacker compromises this endpoint, what can they access next?" This transforms a list of CVEs into a map of actual risk.
Compliance Requirements
NIST CSF v2.0
The Identify function (ID.RA) requires understanding cybersecurity risks:
- ID.RA-01: Document asset vulnerabilities.
- ID.RA-02: Document cyber threat intelligence.
- ID.RA-07: Use threats, vulnerabilities, likelihoods, and impacts to understand risk.
Scoring 500,000 vulnerabilities meets ID.RA-01. Identifying 14 exploitable chains meets ID.RA-07.
NIST 800-53 Rev 5
RA-3 (Risk Assessment) mandates assessing the likelihood and impact of threats. Exploit chain analysis fulfills this requirement, unlike CVSS scores alone.
RA-5 (Vulnerability Monitoring and Scanning) emphasizes remediation based on risk, which includes exploitability in your environment.
ISO/IEC 27001:2022
Control 8.8 (Management of technical vulnerabilities) requires evaluating exposure and taking appropriate measures, not just relying on CVSS.
Actionable Steps for Your Team
1. Map Your Attack Surface
Before your next scan, document:
- External entry points
- Internal network boundaries
- High-value targets
- Trust relationships
When your scanner returns thousands of findings, you'll know which are critical.
Action: Create and update a network diagram quarterly.
2. Prioritize by Position, Not Severity
A medium vulnerability on your API gateway may be riskier than a critical one on an isolated system.
Action: Add "reachability" and "lateral movement potential" to your tracking system. Prioritize high-scoring items.
3. Validate Exploit Chains
Exploit chain analysis identifies potential paths. Penetration testing confirms their viability.
Action: During your next pentest, validate identified exploit chains.
4. Use Threat Intelligence
In 2025, over 48,000 CVEs were published. Use threat intelligence to prioritize chains that attackers are likely to exploit.
Action: Subscribe to CISA KEV. Map paths for new vulnerabilities.
5. Automate Analysis
Manually analyzing 500,000 findings is impossible. Use tools that:
- Ingest scan results
- Map network topology
- Identify exploit chains
- Prioritize based on reachability and impact
Action: Evaluate your current platform's ability to model attack chains. Consider piloting a tool that can.
The difference between 500,000 findings and 14 critical paths is not about data quality but methodology. CVSS scores indicate potential severity, while exploit chain analysis reveals actual risk in your environment. Your compliance standards demand the latter.
