Gartner Report: Fewer Than 10% of Vulnerabilities Exploited, Yet Most Treated as Urgent

According to a recent report published by Gartner and covered by The Hacker News, the cybersecurity industry faces a persistent challenge: vulnerability fatigue. Security teams are remediating more vulnerabilities than ever before, yet breach risk has barely changed. The report highlights that organizations are spending too much time and effort on exposures that attackers may never exploit, while higher-risk exposures sit unaddressed in the remediation queue.

The report states that fewer than 10% of vulnerabilities are exploited in the wild, yet the majority are treated as urgent. This discrepancy leads to inefficient use of resources and leaves critical gaps in security posture. Gartner's analysis argues that prioritization should be based on actual exploit risk rather than traditional severity scores.

To address this, the report outlines four elements of exposure prioritization that organizations should operationalize. While the specific details of these elements require reading the full report, the framework is designed to help security teams focus their remediation efforts on vulnerabilities with genuine exploit risk. The goal is to shift from treating all vulnerabilities as urgent to targeting those with the highest actual risk, thereby improving breach risk reduction per remediation effort.