Economy Opinion Security Software

A better way to prioritise vulnerability management



Digital transformation offers enormous benefits, but equally increases the security threats faced. Continuous Threat Exposure Management, first coined by Gartner, is one of the most effective methods to combat these, says Patrick Evans, CEO at SLVA CyberSecurity


The past few years have witnessed a significant increase in digitisation across businesses and industries, driven largely by the changes wrought by the pandemic. Companies today are far more digitally interconnected than they were prior to 2020, as evidenced by the massive increase in remote working, as just one example.


While this has helped businesses gain new efficiencies and increase productivity, it has also opened these organisations up to new avenues of attack, as remote employees open up new potential vectors for cyber-criminals to exploit.


With hundreds of thousands of software vulnerabilities to manage in this digitally transforming world, it is simply impossible to protect a business from them all. In the past, remediation priority was often tied to Common Vulnerability Scoring System (CVSS) scores, which don’t consider what’s most important for your specific organisation, attack feasibility, active threats, and other aspects of security programs.


Now, research firm Forrester also suggests that relying solely on CVSS scores to prioritise remediations, is flawed because it is not only misaligned with the organisation’s strategic objectives, it also puts too much emphasis on potential, not actual, threats and inflates vulnerability severity.


The Forrester remediation prioritisation triad includes three primary elements you should consider when assessing vulnerability risk: threat likelihood, asset importance, and strength and effectiveness of compensating controls. Assessing each element improves the accuracy of assessing vulnerability risks and provides greater assurance that remediations are properly prioritised and not determined solely on CVSS scores.


Gartner recognised the need for a better approach, with the company’s Top 10 Security Projects for 2020-2021 report suggesting a risk-based vulnerability management approach. The best method of implementing such an approach is Continuous Threat Exposure Management (CTEM), as first coined by Gartner to describe a method that involves consistently exposing a company’s technologies – from networks and systems through to assets – to simulated attacks.


By continuously exposing the business assets to such attacks, CTEM is able to help IT managers identify vulnerabilities and weaknesses, enabling them to improve the enterprise’s overall security posture through the identification of security challenges, as well as the ability to act to address these – before the genuine criminals discover these weaknesses.


CTEM is even more critical when one understands that the sheer number of potential attack vectors and exploits means most organisations will likely only be in a position to remediate around 15% of their active vulnerability count.


Therefore, what is needed is a solution that allows security teams to obtain a view of all their current approaches, and help them to identify where the top 15% of these vulnerabilities lie. With this information in hand, businesses can prioritise these specific threats. And of course, when utilising a CTEM approach, this data is updated on a continuous and evolving basis.


Naturally, context is important. After all, while all businesses have vulnerabilities, their individual level of risk also depends on non-technological factors, like their specific industry vertical and even their geographical location. It is the understanding of such factors, within context, that is where the real threat intelligence lies.


With the right CTEM tool, IT managers are able to view a combination of external threat context, asset criticality, internal compensatory control and patch intelligence. Access to this data will enable them to proactively reduce their attack surface before it gets exploited.


A leading CTEM offering should be able to: show severe risks that might affect the organisation’s most critical assets and which require immediate patching; identify moderate threats to critical assets; indicate high risks to non-critical assets; and moderate risks to non-critical assets.


Ultimately, when looking to implement any kind of Vulnerability Prioritisation Technology (VPT) or Risk-Based Vulnerability Management (RBVM) solution, you should evaluate those vendor platforms that take telemetry data from other existing solutions such as vulnerability scanning data from Nessus, Qualys or Rapid 7.


After all, the missing component is the real-world threat intelligence around what active threat actor groups are doing now, or in the near future, and whether they are targeting your industry, or your geographic location, or both.


By offering a lens through which all these telemetry feeds can be correlated with your own patch intelligence – such as what has been patched and what hasn’t – it can provide your business with a risk-based view that bears no relation to the CVSS score, but rather considers the real world in which you operate.


A solution like this should be able to simulate the breach attack and test the efficacy of your compensatory controls.  In addition, this complete vulnerability management lifecycle approach will have the value of reducing your mean time to exposure [MTTE], an effective KPI for pre-emptive cybersecurity management.


In today’s digitally transforming world, ‘invulnerable’ is not a word any organisation can use to describe its security posture. While it used to be true that no single vendor provided it all, this is no longer the case. A good example of a vendor’s platform that delivers on the Forrester remediation prioritisation triad is Hive Pro’s Threat Exposure Management (TEM) solution, the value thereof can be quickly and effectively validated by submitting a dump of your organization’s vulnerability scan data as a proof of concept. You will be surprised at the vulnerability intelligence you receive back – it is eye-opening!


Faced with such a rapidly evolving threat landscape, it’s virtually impossible to address every risk. The best any IT manager can aim for is ‘well prepared’ – and utilising CTEM is currently the most effective means of achieving this status.

Leave a Comment

Your email address will not be published.

You may also like

Art Business Culture Economy Health Leisure Opinion

Public Outcry Ensues: Hilda Baci’s Dog-Eating Stunt Draws Widespread Criticism




By Chukwudi Iwuchukwu


In a shocking turn of events, Hilda Baci and her friend Eniola have sparked controversy after posting a video on Friday morning showing them consuming a dog delicacy. The video quickly gained attention on Twitter, leaving many viewers distressed and choosing to scroll past it.


The outrage and anger sparked by this stunt were immediate, as numerous people found the video highly offensive. The close resemblance of dogs’ behavior to humans, coupled with their status as loyal companions, led many to express their disapproval. Concerns are now rising about the potential repercussions this incident may have on Hilda Baci’s brand.


It is possible that this dog-eating video could harm her reputation and impact future opportunities. Foreign embassies may refuse her a visa, and she may encounter difficulties in securing positions with foreign food companies. Animal cruelty is a significant concern globally, and making light of such issues can have…

Read More
Announcements Business Culture Entertainment Health





Don Jazzy, one of the finest music producers in the country has recently bagged endorsement with Drip Soap Africa. One of the newest entrant in the Nigerian beauty industry.

With this endorsement,the soap is making headway especially with their market activation at the Lagos International Trade Fair Market .

Peaking on the endorsement,the music master and producer ,Don Jazzy said”Friendly reminder to take your bath before joining us out in the world today. To baff Dey sweet. See as BAYANNI dey happy for slide #DripGang @dripsoapafrica”

The makers of the soap added that there are many variants of the soap and that people can choose any variants according to their skin texture. They have four variants!

In their words they said “Meet the four variants of the Drip Soap namely, Drip Papaya, Drip Vitamin C, Drip Carrot and Drip Gold with their respective unique benefits,…

Read More
Business Economy Events Fintech News Opinion

NITDA’s participation in GITEX Africa is a sign of commitment



As part of its international engagement in promoting initiatives, programmes, and digital innovation in Nigeria, the National Information Technology Development Agency (NITDA) is participating at the ongoing GITEX Africa in Morocco.

The agency is also holding series of side events, including a roundtable discussion on the future of work in Africa, with speakers from NITDA, the Moroccan government, and the private sector.

NITDA’s participation in GITEX Africa is a sign of its commitment to promoting digital innovation in Nigeria and Africa.

The agency is working to create a conducive environment for the growth of the digital economy, create jobs and position Nigeria as a leading player in the global digital space.

Read More
Business Culture Economy Events Investments Telecoms Tourism Trends




The National Information Technology Development Agency (NITDA), has reiterated the need regional collaboration in accelerating digital transformation across Africa, provide opportunities that can propel the continent into a digital era of innovation and inclusive development.

GITEX Africa inaugural edition of technology exhibitions in the region, brings together industry leaders, policymakers, entrepreneurs, and innovators to discuss and showcase advancements in technology.

The event provides an ideal platform for organisations to promote dialogue, showcase innovative solutions, and forge partnerships to harness the potential of the digital age. NITDA’s participation focuses on fostering collaborations, sharing best practices, and addressing the challenges hindering Africa’s digital growth.

Director General of NITDA, Kashifu Inuwa, CCIE, represented by Dr. Aristotle Onumo, Director of Corporate Planning and Strategy, participated at the two Panel Sessions themed: “Accelerating Digital Transformation in Africa: Strategies, Challenges and Opportunities” and “Fast Tracking to an Integrated and Inclusive Digital Public Infrastructure.”

In his presentations, Dr. Onumo discussed…

Read More
Business Economy

Danbatta to Receive National Productivity Order of Merit Award for Outstanding Contributions to Industry



Prof. Umar Garba Danbatta, the Executive Vice Chairman of the Nigerian Communications Commission (NCC), will be conferred with the esteemed National Productivity Order of Merit (NPOM) Award, among other notable Nigerians.

The announcement was made in an advertorial signed by the Director General of the National Productivity Center, Dr. Nasir Olaitan Raji-Mustapha, heralding Danbatta’s exceptional achievements and significant contributions to the development and advancement of the Nigerian telecommunications industry.

The NPOM Award recognises individuals, who have demonstrated exemplary leadership, innovation, and dedication in their respective fields, and Danbatta’s recognition highlights his outstanding contributions to the NCC and the telecommunications sector as a whole.

During his tenure at the NCC, Danbatta has spearheaded several initiatives that have revolutionized the telecommunications landscape in Nigeria. His visionary leadership and strategic decisions have led to remarkable achievements and noteworthy milestones for the industry.

Some of the key accomplishments attributed to Danbatta’s tenure include the promotion of broadband…

Read More
Business Culture Economy

Africa Day: ‘Let’s put our resources at risk behind Africa’s young people’ – Adesina


Delegates attending the 2023 African Development Bank Group’s  ( Annual Meetings in Sharm El Sheikh, Egypt, celebrated Africa Day on Thursday amid hopes for better prospects for the continent and its youth.


The commemoration, which marks the 60th anniversary of the establishment of the African Union, allowed for retrospection by member countries on how the continent can surmount its challenges towards achieving prosperity.


The Bank’s Secretary General Vincent Nmehielle presided over the event.


The audience included Egyptian government ministers and businesspeople who joined the Bank Group’s governors to celebrate the milestone.


Addressing the event, African Development Bank President, Dr. Akinwumi Adesina, said the occasion must provide the impetus for the continent to rise, challenges notwithstanding.


“Africa should lift itself economically, financially, and politically to surmount every hurdle in its way,” Adesina said, stressing that the continent has abundant resources that, if well-managed, can help move it forward.


“We have great sunshine;…

Read More
Business Economy News Technology Technology Trends Telecoms

COURE Celebrates 25 years of Providing Innovative Digital Solutions



COURE Software & Systems Limited (“COURE”), an indigenous information technology (IT) firm located in Lagos, will be marking 25 years of existence, 15 of which have been spent deploying IT solutions and services in Nigeria and other African countries. From telecoms to financial to the public sector, the company has made tremendous strides in various sectors of the economy.

Speaking to the media, COURE’s CEO, Uche Onwudiwe described the company as, “a platform services provider with a focus on the provision of accurate, secure and relevant data to improve its clients’ business processes and operations.” He reflected on the journey so far, noting that the company “started out in the US in 1998 at a time when the internet and modern technology, as we know it, were taking off. At that time, we were focused on networking and physical systems integration.”

</p srcset=

Read More
Announcements Business Economy Fintech Gadgets Technology Technology Trends

Morocco unites global tech community’s commitment to advancing African digital economy at momentous GITEX Africa launch




Debut of Africa’s largest tech and start-up show to welcome 900 companies to explore, discover, and connect to real opportunities in world’s rising digital economy


H.E Dr Ghita Mezzour: “We’re witnessing a historic event, the largest tech networking and business event in the African continent”



Morocco will centre the global tech community’s attention on Africa’s united commitment to advancing the digital economy next week, converging the best minds from governments, businesses, big tech, start-ups, investors and youths to accelerate and catalyse the continent’s ambitious digital transformation journey. 


GITEX Africa 2023, now the largest tech and start-up show in the African continent, will make its highly anticipated debut from 31 May-2 June, with the final preparations underway across ten halls and 45,000sqm of exhibition space in a purpose-built super venue at Place…

Read More