The Critical Failure in Vulnerability Management

The Critical Failure in Vulnerability Management argues that the vulnerability management market is slowing as providers struggle to deliver real security value, with organisations seeking help to fix critical weaknesses, as reported by Amar Ramakrishnan, VP of Product Management, BackBox, on 8 September 2025.

It identifies three main reasons for the slowdown: vendors scaled the surface of vulnerabilities without addressing underlying risk, leading to alert fatigue and a focus on breadth of scanning rather than secure outcomes; the shift to cloud has exposed gaps where traditional vulnerability management struggles to keep pace with complex, multi-vendor network devices; and edge

devices have become the new gateway, with exploitation of vulnerabilities rising from 3% to 22% between 2023 and 2024 and three of the four most-exploited vulnerabilities in 2024 being zero-days affecting edge devices. The piece notes that patching network device vulnerabilities occurs, but only 54% were fully remediated last year, taking a median of 32 days, while the time to exploit vulnerabilities has dropped to five days, according to Verizon.

It highlights several high-profile edge-device flaws, including CVE-2024-3400, CVE-2023-46805, CVE-2024-21887, CVE-2024-21893 and CVE-2023-48788, underscoring the urgency for automation and prioritisation in remediation. The Path Forward advocates prioritising fixes based on network risk, incorporating automation, and closing the loop to ensure vulnerabilities are remediated, so organisations can answer “Yes, we’re secure.”