Fortra:Why Vulnerability Count Doesn't Predict Breach Risk

Name: Fortra:Why Vulnerability Count Doesn't Predict Breach Risk
Uploaded: 2026-07-10T11:49:18-04:00
Duration: 1 min 5 s
Description: Most security teams are drowning in vulnerabilities, but are they fixing the right ones? Cybersecurity expert Robert RSnake Hansen challenges a core assumption of vulnerability management: more vulnerabilities doesn't necessarily mean more breaches or...

Fortra

07/10/2026

0 (0%)

Report Like Favorite

TL;DR

Many large organizations carry hundreds of millions of vulnerabilities and have still never experienced a material breach or measurable business loss.
Raw vulnerability counts do not meaningfully correlate with breach likelihood or financial loss, making them an unreliable prioritization metric.
RSnake argues that patch management strategy should be driven by breach probability and business impact rather than total vulnerability volume.

Summary

In this short clip from The Art of Security podcast, cybersecurity expert Robert "RSnake" Hansen challenges one of the most deeply held assumptions in vulnerability management: that a high vulnerability count signals high risk. Hansen points out that many large organizations carry tens or even hundreds of millions of vulnerabilities in their environments — and yet have never suffered a material breach or measurable business loss. His central argument is that raw vulnerability counts simply do not correlate with actual breach likelihood or financial impact, making them a poor basis for prioritizing remediation efforts. Rather than chasing every CVE in the queue, Hansen advocates for a risk-based patching strategy grounded in breach probability and business impact. The implication for security teams is significant: patch management should be informed by what actually drives losses, not by what inflates a vulnerability dashboard. This clip serves as a provocative entry point into a longer episode exploring how organizations can rethink their approach to vulnerability management in a world where perfect remediation is impossible.

Chapters

0:00 - The Vulnerability Overload Reality
0:19 - Does Volume Actually Matter?
0:28 - No Correlation with Loss or Breach
0:41 - Rethinking Patch Prioritization

Key Quotes

0:00 "Many companies now that have over 10 million vulnerabilities and up to hundreds of millions of vulnerabilities — these things are just littered with vulnerabilities."
0:28 "It turns out it doesn't really correlate with loss or even breach, which is a lower bar."
0:41 "If you're going to patch, clearly, that's not the way to do it. Clearly, that is not having the most impact on breaches and losses."
0:51 "That's kind of where I like to draw the line and where the breach and loss informs your patch management."

FAQ

Does having millions of vulnerabilities mean a company is at high risk of being breached?

Not necessarily, according to RSnake. He notes that many companies with over 100 million vulnerabilities have never been compromised or suffered business impact, suggesting vulnerability count alone is a poor predictor of breach risk.

What should drive patch management decisions if not vulnerability count?

RSnake argues that breach likelihood and business loss should be the primary inputs — patching should focus on vulnerabilities most likely to result in an actual compromise or measurable financial harm.

Categories:

» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Becoming Agent Ready with Cyera: Essential Strategies and Insights

Verge.io: Can You Afford Your Next Storage Refresh?

Summer of Satori: FunFoneFarm's Transformation of Fraud into Seamless Integration