Vulnerability management complexity is leaving enterprises at serious risk
Fragmented data and siloed processes mean remediation is taking too long


Most organizations are failing to remediate critical vulnerabilities quickly enough, with nearly seven-in-ten saying it takes them more than 24 hours.
According to new research from Swimlane, fragmented data from multiple scanners, siloed risk scoring, and poor cross-team collaboration means organizations are increasingly exposed to breaches, compliance failures, and financial penalties.
Michael Lyborg, CISO at Swimlane, said this confluence of issues and the “growing complexity” of vulnerability management has prompted a widespread rethink of how enterprises approach dangerous flaws.
"It’s no longer just about patching vulnerabilities — it’s about prioritizing the ones that matter most to your operations. With businesses losing an estimated $47,580 per employee each year due to manual tasks, organizations can no longer afford to operate in the reactive mode of the past."
The main reason for failures in prioritization is a lack of context or accurate information, cited by 37%, with 35% saying that's the primary reason for delays in fixing vulnerabilities too.
More than half of organizations still lack a comprehensive system for vulnerability prioritization. And while nearly half (45%) use a hybrid approach combining manual and automated processes for vulnerability detection, seven-in-ten rely on tools like cloud security posture management, and a similar number use web application scanners.
These manual processes are using up significant resources, the study noted, with 57% of security teams dedicating between a quarter and half of their time to vulnerability management operations.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
More than half spend over five hours a week consolidating and normalizing vulnerability data, while a similar number said the limited usefulness of scanner results means they need to use additional tools and processes.
Nearly two-thirds said they weren't confident that their vulnerability management programs can meet regulatory audit requirements, and 73% expressed concern over potential fines.
Similarly, six-in-ten reported that siloed vulnerability management practices are creating inefficiencies and exposing their systems to potential security risks.
"Smarter prioritization and automation are no longer optional — they are essential to reducing vulnerabilities, preventing breaches and ensuring continuous compliance," said Cody Cornell, co-founder and chief strategy officer at Swimlane.
RELATED WHITEPAPER
"By blending intelligent automation with human expertise, vulnerability management teams gain the clarity they need to act decisively. Centralizing data and responding in real-time isn’t a luxury — it’s a business imperative that minimizes risk and frees up time to focus on the next challenge."
Last year, researchers at Black Duck found that the utilities sector was the worst performer in dealing with security flaws, with an average of 876 days to close critical vulnerabilities in medium-sized sites. The education sector was also slow.
Perhaps because of the sector's heavy regulation, healthcare organizations were quicker to act, with an average of 87 days to close critical security vulnerabilities for small sites, 30 days for medium sites, and 20 days for large sites.
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
Security experts issue warning over the rise of 'gray bot' AI web scrapers
News While not malicious, the bots can overwhelm web applications in a way similar to bad actors
By Jane McCallion Published
-
Does speech recognition have a future in business tech?
Once a simple tool for dictation, speech recognition is being revolutionized by AI to improve customer experiences and drive inclusivity in the workforce
By Jonathan Weinberg Published
-
Law enforcement needs to fight fire with fire on AI threats
News UK law enforcement agencies have been urged to employ a more proactive approach to AI-related cyber crime as threats posed by the technology accelerate.
By Emma Woollacott Published
-
Have I Been Pwned owner Troy Hunt’s mailing list compromised in phishing attack
Troy Hunt, the security blogger behind data-breach site Have I Been Pwned, has fallen victim to a phishing attack targeting his email subscriber list.
By Jane McCallion Published
-
300 days under the radar: How Volt Typhoon eluded detection in the US electric grid for nearly a year
Analysis Lengthy OT lifespans give attackers time to penetrate networks underpinning critical infrastructure and plan future disruption
By Solomon Klappholz Published
-
Cybersecurity teams face unparalleled pressure, but they’re stepping up to the plate
News While cybersecurity teams are contending with rising workloads and chronic staffing issues, new research shows practitioners are still charging ahead and meeting targets.
By Emma Woollacott Published
-
Broadcom issues urgent alert over three VMware zero-days
News The firm says it has information to suggest all three are being exploited in the wild
By Solomon Klappholz Published
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claim
News Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
By Solomon Klappholz Published
-
Developer security best practices in a fast growing tech company
Whitepaper A buyer's guide for meeting the unprecedented speed and complexity of today's development practices
By ITPro Published
-
Everything you need to know about the Microsoft Power Pages vulnerability
News A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
By Solomon Klappholz Published