The shift away from vulnerability management
Vulnerability management asks which flaws exist on the assets I know about. Exposure management asks what an adversary can reach from outside, including what is not in the inventory, and how much of that they can actually use today.
The difference shows up in the unit of work. In the first model, the item is a CVE. In the second, it is a path: a specific asset, reachable in a specific way, carrying a flaw with known exploitation, supporting a specific business process.
Why a CVSS-ordered queue fails
CVSS measures the potential damage of a flaw under ideal conditions for the attacker. It says nothing about the probability that anyone will try. There are 9.8 CVEs published years ago with no known exploit, and medium-scored flaws in active campaigns right now.
The result is a queue that burns the team's capacity on items that are serious on paper while the one the adversary will use next week goes untouched.
Three signals improve the ordering, and none of them is CVSS: presence in the CISA KEV catalog, a working public exploit, and a high EPSS probability. The fourth, and the one that matters most, is knowing what is under attack right now.
What the discipline requires in practice
An inventory that updates itself, because the forgotten asset is exactly the one that becomes the way in. Ownership attribution, because without an owner nothing gets fixed or switched off. Validation, because a detected exposure is not an exploitable one. And mobilization, turning all of it into tickets with deadlines, which is where most programs stall.
The framework that organizes this cycle into five phases is CTEM.