Meriam ElOuazzani, Vice President for Middle East, Turkey and Africa at Censys
vulnerability events closed increased 6.5 times between 2022 and 2025.
Despite this increased activity, the proportion of critical known exploited vulnerabilities remaining unresolved one week after disclosure rose from 56 % to 63 %.
Security teams are therefore remediating more vulnerabilities without necessarily reducing exposure quickly enough.
Jaafarawi also estimates that fewer than 1 % of vulnerabilities classified as critical are exploited in real-world attacks. This highlights the inefficiency of treating every critical vulnerability as an equally urgent threat.
Artificial Intelligence is further complicating the situation by accelerating vulnerability discovery and enabling attackers to combine weaknesses into sophisticated exploit chains.
Meriam ElOuazzani, Vice President for Middle East, Turkey and Africa at Censys, argues that the problem goes beyond the growing number of vulnerabilities.
Traditional vulnerability management, she explains, was never sufficient when treated purely as a list of fixes. It identifies technical weaknesses without necessarily revealing which ones attackers are most likely to exploit.
The real challenge is determining what is externally reachable, exploitable and significant to business operations.
Prioritising what actually matters
Enterprise security teams may encounter thousands of vulnerabilities across their infrastructure, making effective prioritisation essential.
The Common Vulnerability Scoring System( CVSS) provides a standardised assessment of technical severity, but a high score does not automatically indicate a high level of business risk.
Jaafarawi advocates combining three dimensions: threat, environmental and business context.
Together, these factors allow security teams to distinguish genuinely dangerous exposures from findings that present limited practical risk.
An internet-facing application supporting critical financial transactions, for example, may warrant greater attention than an equally severe vulnerability on an isolated development system.
ElOuazzani believes the difficulty is often translating technical findings into meaningful business decisions.
A vulnerability becomes particularly significant when it is externally reachable, affects an essential service or can be exploited before remediation is completed. The objective should therefore be to identify the relatively small number of exposures capable of causing serious operational or financial consequences.
This requires collaboration between cybersecurity teams, IT operations and business owners, particularly when remediation could disrupt critical services.
Moving towards continuous exposure management
Traditional security assessments provide snapshots of an organisation’ s security posture. However, enterprise environments change constantly.
Cloud resources are created and removed, applications are updated, configurations change and new vulnerabilities emerge. An assessment conducted only days earlier may no longer reflect the actual attack surface.
Continuous threat exposure management addresses this challenge through an ongoing cycle of discovery, prioritisation, validation and remediation.
Jaafarawi considers validation particularly important because prioritisation alone cannot establish whether an attacker can successfully exploit a weakness.
Security teams need evidence that an attack path is genuinely accessible and that existing defensive controls cannot already prevent exploitation.
Threat intelligence establishes whether a vulnerability is being actively exploited or weaponised. Environmental context determines whether the conditions required for exploitation exist within the organisation. Business context identifies the importance of the affected asset.
ElOuazzani emphasises the value of examining infrastructure from an attacker’ s external perspective.
A service that disappears from a scheduled scan may not have been eliminated. It could have
26 WWW. INTELLIGENTCISO. COM / MIDDLE-EAST