Research conducted by Hackuity, a provider specialising in risk-based vulnerability management, highlights the growing challenges faced by security teams due to the increasing volume of Common Vulnerabilities and Exposures (CVEs).
This latest Vulnerability Management Report offers insights from 200 IT security decision-makers across the UK and the Asia-Pacific region, spotlighting the hurdles in managing these vulnerabilities effectively.
Mounting pressure on security teams
The report reveals that the surge in CVEs is exerting considerable pressure on security teams, with 46% of respondents indicating that the rising volume is straining their resources. This pressure impacts not only organisational security measures but also adversely affects the well-being of staff.
Notably, 26% of participants admitted that this strain has contributed to data breaches, while 36% reported that it resulted in regulatory fines. Additionally, over one-third noted delays in incident response (36%) and missed security alerts (33%) as a direct consequence. Furthermore, 38% acknowledged that this pressure has led to employee burnout.
Consequences and organisational impact
Sylvain Cortes, Hackuity's VP of Strategy, commented on these findings: “We know that teams are feeling the pressure right now - but what’s most concerning is the knock-on effect this is having on organisations and on the team’s well-being.”
Cortes emphasised the real-world repercussions of not managing vulnerabilities efficiently, noting, "From missed alerts to fines, there are real consequences at play when vulnerabilities aren’t managed in a way that’s making the best use of team’s time and expertise. The nonstop flood of alerts isn’t just stressful, it’s costly.”
Vulnerability management processes
Managing and processing vulnerabilities has become increasingly crucial. While a majority (77%) of organisations claim to have formalised processes for vulnerability remediation, only 36% employ a risk-based approach that evaluates vulnerabilities based on asset criticality, exploitability, and business impact.
Vulnerability management priorities
Vulnerability management (VM) does not appear to be prioritised highly, with 60% of respondents acknowledging that it is not given the focus afforded to other IT security projects. Some further key findings from the report include:
- Critical vulnerabilities generally take about four weeks for remediation; however, 21% of organisations reported that remediation could take up to three months.
- Operational constraints (reported by 43%) and budget limits (41%) hindered vulnerability management efforts. Additionally, a lack of skills within teams (29%) and high staff turnover (25%) are cited as barriers to improving VM practices.
Sylvain Cortes added: “Security leaders need to look at how they’re equipping their teams to make sure they can keep pace with the rising volume and complexity of vulnerabilities. Without context and intelligence around the alerts, they risk wasting valuable time and resources chasing down threats or missing alerts that could pose the greatest risk for their organisation."
Find out about secure physical access control systems through layered cybersecurity practices.
