In its latest research, Gartner® highlights the challenges security and I&O leaders face in managing vulnerabilities effectively. Many organizations rely too heavily on patch management, overlooking the broader attack surface and missing critical risks.
This report offers a new path emphasizing attack surface management, prioritized analysis, and improved collaboration between I&O and security teams.
Key Findings:
- Patch management is seen by leadership, security and infrastructure and operations (I&O) teams as the primary method to remediate vulnerabilities and other exposures, leading to an overemphasis on patching.
- Vulnerabilities are primarily assessed using the common vulnerabilities and exposures/common vulnerability scoring system (CVE/CVSS), which results in efforts to address only critical and high CVSS scores rather than prioritizing those that are most risky to the organization.
- Application vulnerabilities receive less priority, with resources often misallocated to addressing well-understood remediation options that give the organization a false sense of security.
Gartner® recommends:
- Improve response time using threat management techniques to identify and implement mitigation controls when patch remediation can be completed.
- Refocus on cyberthreat vulnerabilities, not just the assigned criticality, by implementing continuous threat exposure management (CTEM) and taking into account the critical context of your specific organization.
- Reduce attack surface exposure by assessing additional asset classes and their organizational impact to ensure resources are applied where most needed, rather than focusing solely on traditional vulnerability remediation areas such as operating systems.
Download the Gartner® 2025 report, We’re Not Patching Our Way Out of Vulnerability Exposure, to learn how to understand better, prioritize, and remediate security exposures.
Attributions and Disclaimers:
Gartner, We’re Not Patching Our Way Out of Vulnerability Exposure, Chris Saunderson, Craig Lawson, Mitchell Schneider, 24 February 2025
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.
Gartner does not endorse any vendor, product, or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designations. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
