Making sense of vulnerability overload [Q&A]

The volume of security vulnerabilities continues to soar, leaving overwhelmed security teams struggling to separate genuine threats from background noise.

Hackuity’s latest Vulnerability Management Report highlights how this rising pressure is contributing to vulnerability overload with missed alerts, delayed responses and, in many cases, costly breaches.

We spoke to Sylvain Cortes, VP strategy at Hackuity, to discover why traditional approaches are no longer fit for purpose, and how context, collaboration and automation can help organizations regain control.

BN: Why are organizations finding it so difficult to keep pace with the rising number of vulnerabilities? What impact is this having on security teams?

SC: The scale of today’s vulnerability landscape is unlike anything we’ve seen before. Every year sees more CVEs recorded than the one before, but it’s not just a case of volume. Organizations are also dealing with increasingly complex environments spanning cloud, on-premises, and third-party services, which means every new CVE has far more potential touchpoints than it did even a few years ago.

The challenge is no longer just about identifying vulnerabilities but working out which ones genuinely matter to your business. Without that clarity, teams get trapped in a constant cycle of reacting to whatever appears next on the list.

Our research found just how serious this problem has become. Nearly half of security teams told us the sheer volume of vulnerabilities is putting significant strain on their resources, and that pressure has very real consequences. When analysts are bombarded with alerts, fatigue sets in, focus drops, and critical issues get buried among routine ones. That is how missed alerts, delayed incident response, and burnout start mounting up and increasing the chances of a cyber incident. In fact, more than one in four organizations say this overload has directly contributed to a data breach.

It’s a continually overwhelming situation because if everything looks urgent, nothing truly is. The problem isn’t a lack of talent or effort; it’s that teams are being asked to manage risk without the context needed to make the right decisions at the right time.

BN: Your research suggests many organizations still use compliance-driven approaches to vulnerability management. Why is this a problem, and what does a more effective, risk-based model look like?

SC: Compliance frameworks play an important role in managing vulnerabilities, but they were never designed to be a day-to-day prioritization engine. One of the issues is that a purely compliance-driven approach encourages teams to treat all high-severity vulnerabilities as equal, regardless of the context in which they appear.

In practice, this often results in resources being spent on issues that are unlikely to impact the business, while genuinely dangerous weaknesses wait in the queue. Our research shows that only around a third of organisations have adopted a true risk-based model, which means many teams are allocating time and budget in ways that do not reflect real-world exposure.

By contrast, a risk-based approach is rooted in understanding why something matters. That starts with asset context: what system is affected, how critical is it to the organization and how exposed is it?
Then we overlay threat intelligence, such as whether proof-of-concept exploits exist or if the vulnerability appears in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Finally, we consider business impact — a flaw on a payment system or customer-facing platform, for example, carries far more weight than one on an isolated test machine.

When teams combine these factors, their backlog shrinks to a fraction of its original size. Suddenly, they are not chasing compliance checkboxes but tackling the vulnerabilities that they know pose the greatest real risk to the organization.

BN: The report also highlights long remediation times, with many organisations taking weeks or even months to fix critical vulnerabilities. What practical steps can organizations take to reduce MTTR?

SC: It’s usually caused by systemic issues; a combination of fragmented visibility, manual processes and lack of clear ownership That slows everything down, particularly when scanning tools, cloud platforms and asset inventories all operate in isolation and don’t provide context.

Our research shows the impact of these issues. The average time to remediate a critical vulnerability is around four weeks, and for some organizations it stretches into several months. That’s a huge window for threat actors to exploit an active vulnerability.

When you look at organizations with the fastest MTTR, you see several things in common. First, they typically consolidate their data so analysts no longer have to piece context together manually. A unified view of assets, exposures and threat intelligence immediately cuts through decision-making delays. Second, they automate routine steps such as de-duplication, enrichment and ticket creation. We’ve found this can reduce MTTR by an average of a full week in fully automated environments.

Ownership matters too. Remediation moves faster when it sits with the teams best equipped to understand the risk, such as cybersecurity or SOC teams, rather than being scattered across infrastructure roles. And finally, clear processes between security and operations such as shared runbooks, automated handoffs, and defined SLAs remove the friction that often slows remediation to a crawl.

BN: Let’s talk about the Operations Centre (VOC) model, what benefits does this approach offer, and how can teams begin that transition?

SC: The VOC represents the next evolution of vulnerability management because it gives teams the structure they need to cope with today’s volume and complexity. Instead of juggling disconnected tools, spreadsheets and tickets, the VOC brings everything together into a single operational hub.

It provides real-time visibility across all vulnerabilities, assets and risk levels, enriched with threat intelligence and business context. That shift alone dramatically improves decision-making, because teams finally have a complete and dependable view of their exposure.

Our research shows a growing momentum towards this model, with nearly half of UK organizations and a majority in APAC already moving in this direction. Those who have adopted a VOC model report benefits including faster prioritization, reduced noise, fewer manual tasks and far less analyst fatigue. When triage, enrichment and routing are automated, teams can focus on the vulnerabilities that genuinely matter rather than firefighting every new CVE.

For organizations just starting out, a VOC doesn’t need to be a huge transformation from day one. The first step is centralizing vulnerability data so teams are working from a single source of truth. From there, automation can be introduced gradually, followed by consistent prioritization of rules and cross-team governance. In time, the VOC becomes mission control — enabling teams to operate with foresight rather than reactiveness.

Image credit: Wavebreakmedia/depositphotos.com