About the report
How Exposure Management Stalled Between Adoption and Operation
About the report
How Exposure Management Stalled Between Adoption and Operation
91% of organizations run some form of exposure management, but few can show it’s reducing risk. SANS surveyed 410 IT and security professionals to find out where programs lose momentum. Inside the report:
- Why only 7% of programs run continuously
- How fragmented exposure data slows prioritization and remediation
- Why the top remediation barriers are organizational
Webcast session
Acting with confidence on exposure data
Brinqa’s SVP of SE & Alliances, Jay Klauser, explains what’s eroding confidence in prioritization and what it takes to operationalize an exposure management program. He covers unified data, business context, and automated routing to the right owners.
Key findings
Adoption is nearly universal. Outcomes are still catching up.
Source: SANS 2026 Exposure Management Survey
91%have implemented exposure management
7% run it continuously
15% are very confident they prioritize the right exposures first
16% have fully centralized their exposure data
Inside the findings
Where programs lose momentum
Inside the findings
Where programs lose momentum
- Asset inventory. 46% name unreliable asset inventory as their top prioritization blocker.
- Scattered data. 44% pull findings from six or more systems.
- Unclear ownership. 44% say remediation responsibility is spread across too many teams.
- Exposure debt. 38% saw minimal or no measurable risk reduction last year.
Panel: Risk owners and remediation owners are different roles
44% of organizations say remediation responsibility spread across multiple teams is their top barrier to fixing exposures, and 37% cite unclear system ownership. On the SANS panel, Jay Klauser separates the business owner who carries the risk from the team that implements the fix, and explains why both roles need to be clear.
See how Brinqa’s AI Attribution Agent fills in missing ownership, including remediation and business owners, using patterns in the data your organization already has. Each suggested owner comes with a confidence score, so teams can see why work was routed where it was.
SANS key takeaways
What the research recommends
SANS traces the gap between adoption and results to organizational choices more than missing technology. Its recommendations focus on the structural work that helps programs reduce risk.
01 Fix ownership first.
Named accountability moves fixes faster than another tool.
02 Consolidate before automating.
Centralized data comes first.
03 Measure outcomes.
Track risk reduction and prioritization confidence.
Brinqa and exposure management
Connect what you see to what you fix
Brinqa and exposure management
Connect what you see to what you fix
The Brinqa Platform connects to more than 300 security and IT tools, unifies their findings in the CyberRisk Graph™, and maps each finding to an accountable owner. Teams work from one shared picture of risk, with decisions you can defend.
FAQs
Research from the SANS Research Program, written by Jonathan Risto and sponsored by Brinqa. It surveyed 410 IT and security professionals on how they discover, prioritize, and remediate exposures.
Responsibility spread across multiple teams (44%), operational disruption (39%), competing priorities (39%), and unclear system ownership (37%).
SANS recommends measuring outcomes over adoption. Only 15% of organizations report significant risk reduction, and only 15% are very confident in their prioritization.
SANS presented the results on October 7, 2026. Brinqa’s SVP of Sales Engineering and Tech Alliances, Jay Klauser, presented a session and joined a panel on remediation ownership and measuring risk reduction.
