How to Tell Whether Your Exposure Management Program Is Reducing Risk

"Did we reduce more than we brought in? I would argue that's almost impossible right now with the number of new vulnerabilities... You're never gonna win that race."

That's a key point made by Jay Klauser, Brinqa's SVP of Alliances and Sales Engineering, during a panel discussion at the SANS 2026 Exposure Management Survey Insights event. The message: When a program reports progress as fixes against new findings, it's tracking a number that rarely moves in its favor.

The survey data points the same way. 91% of the organizations the SANS Institute surveyed have an exposure management program in place, yet only 15% could say it had significantly reduced their risk over the past year, and just 15% were confident they prioritize the right exposures first.

SANS’ analysis concludes that a program should be judged by how much risk it reduces. That was a main focus for the panel, which spent much of its time on what this means day to day – which numbers to track, which ones to stop relying on, and how to explain the results to the business.

What the survey shows about outcomes

For most organizations, progress over the past year was more modest: 42% of respondents saw a moderate reduction in exposure risk, 30% a minimal one, and 8% no measurable change. SANS reads the 38% in those last two groups as exposure debt accumulating faster than programs can retire it. Exposure debt is the backlog of unresolved exposures that builds when discovery outpaces an organization's capacity to prioritize, validate, and remediate.

Confidence tells a similar story. Most respondents (49%) are somewhat confident they're prioritizing the right exposures first, an answer SANS sums up as "We think so, but we cannot prove it." That distance between believing and proving is the finding Jay built his session around, and in our view, it's the one that matters most.

Why counting fixes can't show progress

As Jay pointed out, many organizations fold exposure management into their existing vulnerability management program and keep reporting the same numbers, like criticals remediated within SLA and findings closed against findings opened.

The trouble is what they leave out. Activity counts can't show whether exposure is shrinking, and with new vulnerabilities arriving every week, keeping pace on volume is the race Jay called unwinnable. A program measured this way can look busy while its exposure debt grows.

What to measure instead

If volume can't show progress, the measures have to sit closer to risk itself. The SANS data and the panel discussion point to three.

1. Reduction in exploitable exposure

The first is a sharper definition of critical. Jay argued for one built on exploitability: "A critical is what is likely the most exploitable exposure in our environment." The question to answer becomes "am I driving down the exploitable exposures in my environment that have a broader blast radius?"

Many teams already have the right instincts here. In the survey, asset criticality or business impact and known exploit availability (44% each) now rank alongside CVSS severity (43%) as top prioritization factors. The next step is reporting progress against those same factors, so the numbers leadership sees reflect the exposures most likely to be exploited.

Jay Klauser on redefining what counts as critical.

2. Confidence in prioritization

A sharper definition only helps if teams trust the rankings that come out of it. That's why SANS treats confidence in prioritization as one of two numbers that matter more than adoption, alongside real risk reduction. As the report puts it, "Adoption isn't the win, those two numbers are."

Confidence is easiest to measure through what erodes it. When the survey asked what prevents effective prioritization, the top answers were unreliable or incomplete asset inventory (46%), too many findings to act on (43%), and lack of asset context and insufficient automation (42% each). Exposure data fragmented across tools followed closely at 41%.

Jay pointed to another factor: black-box scoring models, which he said erode trust in the data itself. We'd take that a step further. If a team can't explain why a finding ranked where it did, leadership has little reason to trust the decision to fix it first, or to leave it for later.

3. Ownership of the fix

Even a well-prioritized exposure stalls without someone to fix it. The report's first takeaway is to fix ownership first, with clear, named accountability for remediation timelines. The top remediation barrier in the survey is responsibility spread across multiple teams (44%), and 37% cite unclear system ownership. Tracking whether exposures have an accountable owner shows whether the program can move from finding to fix, which is why Brinqa's approach to asset ownership focuses on this step.

For a broader set of program measures, see our guide to vulnerability management metrics.

Report outcomes in terms the business uses

Better measures still have to reach the people who decide what gets fixed. Kapil Gupta, VP of Security Solutions at Fortinet, said his customers tell him "your dashboard is great," but they can't take it into board or senior management meetings. He recommends tying exposures to potential revenue loss, loss of customer data, or legal ramifications. He also warned CISOs to expect the follow-up question once they do: "How do we really go ahead and remediate? Can you really own this?"

That's where the ownership measure pays off. Jerry Caponera, SVP of Risk and Threat Exposure Management at Dataminr, pointed out that business owners often make the remediation call, so "you have to talk to the business owner in language they understand." Sometimes that call is to defer a fix, which he described as "a legit decision that we all hate." Security's role is giving the business enough context to make that decision.

Jerry Caponera on reporting in the business owner's language.

Jonathan Risto, the report's author, offered a practical test: "being able to explain how your exposure management program is supporting the key objectives of the sales team that they have for this quarter." It's a high bar, and a useful one, because a program that can clear it is already reporting outcomes the business recognizes.

Measurement is a leadership decision

The 7% of respondents who run exposure management continuously describe programs that combine integration, automation, and ongoing measurement. SANS is clear that none of those arrive by default: "The scarce resources in exposure management are decision authority and remediation throughput. Neither arrives with a purchase order."

That puts the next move with leadership. The report calls for someone senior enough to tie asset ownership to remediation timelines and make it stick. The measures in this post give that person something to hold the program to: whether exploitable exposure is going down, whether teams trust what they're prioritizing, and whether every exposure has an owner.

Jay closed his session with the goal behind all of it: "We have to be able to get ourselves in a position where we act with confidence so that we can start to truly remediate and reduce risk." Measuring outcomes is how a program gets there, and how it gives leadership decisions they can explain.

FAQs