Key Points
We’re coming down from a fantastic time at teissLondon2025 - the first time Intruder has participated - and we have only good things to say!
As part of the event, we hosted a roundtable on Vulnerability Management: Moving From Chaos to Confidence. Hosting a roundtable on vulnerability management felt like a risk in itself - if we don’t put ‘AI’ in the title, will people even show up?! And if they do, will they be willing to share their war stories?
Well, we were pleasantly surprised to discover that attendees were intrigued and keen to tackle some of the hardest questions head-on.
Our discussion centered around questions like: Does vulnerability management even come up in board meetings? If not, why not? And, how would you explain to leadership that having 1,000 vulnerabilities doesn’t necessarily matter?
These questions sparked a lively conversation on how security teams can better communicate risk and prioritize action. Here are our top 10 takeaways.
Top 10 takeaways from our roundtable
- For many organizations, vulnerability management is not a high-priority topic at the board level. If it is on the agenda at all, it’s often just a small part of a wider discussion.
- Boards with a higher risk appetite usually only pay attention when something has already gone wrong. For this reason, security leaders need to learn how to speak the board’s language: risk.
- When discussing vulnerability management at the board level, it can be helpful to frame it in terms of three key areas: money, data, and systems.
- The board isn’t interested in a single metric in isolation; they care about identifying trends. For example, rather than focusing on how quickly critical vulnerabilities were remediated, illustrate whether the situation is improving over time.
- Sometimes, you have to wait until a vulnerability is of interest to have your moment with the board. You may have to explain to them that even if a vulnerability is serious or highly exploitable, you may not be able to immediately fix it, due to the risk and cost of disrupting operations - for example, taking out a major bank's call center.
- Context is king! Teams need to focus on what truly matters, rather than chasing numbers that don’t reflect real risk. For example, tracking the total number of vulnerabilities can be misleading if most affect low-priority assets with minimal business impact.
- Vulnerability management isn’t just about reporting numbers - it’s about making informed decisions. Instead of presenting raw counts, ask: What’s the actual risk? Factor in exploitability, impact on live systems, and business risk to ensure efforts are focused where they matter most.
- Vulnerability management can be noisy, and not all vulnerabilities are created equal. Focus on these questions to help prioritize:
- How severe are the vulnerabilities?
- What’s the likelihood of exploitation?
- Where are they located in the infrastructure?
- How long have they been present?
- What’s the overall risk to the business?
- A powerful way to frame vulnerability discussions with leadership is to start with: “I need help with…”. This approach shifts the conversation from a pure reporting exercise to a problem-solving discussion.
- The board may include someone who is more technical than members of the leadership team. With the right approach, it may be possible to use that person as a lever to help translate security concerns into a language that resonates with the management layers and the executive team.
Move from chaos to confidence with Intruder
Our roundtable reinforced that vulnerability management isn’t just about fixing vulnerabilities - it’s about understanding risk, communicating it effectively, and prioritizing what truly matters.
Intruder empowers teams to do just that. With real-time, accurate scanning and intelligent risk prioritization, we help businesses focus on the exposures that are most relevant to them. And our proactive approach limits the window of risk, continuously monitoring for new threats while eliminating the noise that slows teams down.
Want to learn more? Let’s chat about how Intruder can help you focus on the risks that matter most.
Camilla works with organizations to enable them to transition from reactive vulnerability management to proactive attack surface management. She has experience in supporting CISOs and security teams with transformation programs, strategic ethical hacking projects, and defensive cyber response. Her earlier career involved supporting executives and non-executives with business transformation, board work, and portfolio career transitions. She has experience as a board member of a Finnish cyber security PLC, and takes a broad interest in organizational design, culture, strategy and the interplay between them.
