Severity Scores Don't Equal Risk
Security teams have gotten very good at finding vulnerabilities. The harder, less-solved problem is figuring out which of those findings actually matter — and a growing body of practitioner guidance argues that CVSS severity alone is the wrong yardstick for that decision.
A critical-rated flaw sitting behind strong network segmentation may pose minimal real-world threat. Meanwhile, a medium-severity issue on an internet-facing system can become genuinely dangerous the moment it's chained with one or two other, individually unremarkable weaknesses. Severity scores describe what a vulnerability could mean in isolation; they say nothing about whether an attacker can actually reach it, chain it, and turn it into a compromise.
From Point-in-Time Scanning to Continuous Validation
Traditional vulnerability management leans on periodic scans and static severity ratings — a model that struggles to keep up with environments that change daily through new deployments, configuration drift, and shifting network exposure. The alternative gaining traction is continuous validation: repeatedly testing whether an attacker could actually chain a given exposure into a real compromise path, rather than relying on a snapshot taken weeks or months earlier.
Autonomous Penetration Testing as the Mechanism
One approach highlighted in the discussion is autonomous penetration testing — automated systems that perform reconnaissance, attempt to chain discovered vulnerabilities together, test business logic flaws, and validate which exposures represent a credible path to compromise. One such platform, Breach360, is described as having been trained on more than 40,000 real-world penetration testing engagements to inform how it evaluates attack paths.
The pitch is straightforward: instead of triaging a vulnerability backlog by CVSS score, teams triage by demonstrated exploitability — what an attacker could actually pull off given the current state of the network, not what a scanner flags as theoretically severe.
AI Is Cutting Both Ways
The same automation trend lowering the barrier for defenders to continuously validate their exposure is also lowering the barrier for attackers to run sophisticated, multi-stage intrusions at scale. That symmetry is part of the argument for continuous validation in the first place — if adversaries are increasingly capable of chaining low-and-medium severity issues into full compromises with AI-assisted tooling, static severity-based triage falls further behind.
Human Judgment Still Matters
None of this replaces human decision-making. Business context — what a compromised system actually touches, what data it holds, what regulatory exposure follows a breach — still has to come from people who understand the organization. What automated, continuous validation changes is the evidence teams have available when making that call: demonstrated attack paths instead of a static severity label.
Why This Matters
Most vulnerability management programs are still built around triaging by CVSS score, which all but guarantees some genuinely dangerous, chainable exposures sit unaddressed behind a queue of "critical" findings that turn out to be unreachable. Shifting toward exploitability-based prioritization — whether through autonomous testing tools or disciplined manual attack-path analysis — is a more direct way to answer the question that actually matters: not "how bad could this be," but "can someone actually do this to us right now."
Source: The Hacker News