Why VM Programs Suck
This is the conversation I have with VM leads every week.
It usually starts at minute thirty of a discovery call, after the official agenda is over and the Zoom faces relax. Someone says "can I be honest with you for a second?" and then I get the list. Same complaints. Different shop. Five years running.
The complaints are not about tools. The tools mostly work. The complaints are about a job that has slowly turned into something nobody signed up for. Ticket-triager with a security title. Spreadsheet janitor. Compliance-evidence factory. Words I have heard from senior engineers in the last ninety days.
Here is what I have stopped pretending. Vulnerability management, as practiced today, is not security work. It is the paperwork that surrounds security work, scaled to a volume no human team can keep up with, against an adversary who has stopped operating at human speed. It sucks. Saying so is the first step.
The pairs that follow are real. The left column is what I have heard, in those quiet moments after the agenda ended, in shops across healthcare, financial services, federal, energy, and tech. The right column is what those same people tell me their lives look like six months after the program shifts to continuous threat exposure management. Eight pairs. Two columns. One uncomfortable comparison.
The job nobody signed up for is the job we keep accepting. Until we stop.
A note on the format. The quotes in the left column are composites, drawn from dozens of conversations and intentionally anonymized. They are not edited for tone: the venting is the point. The quotes in the right column are from operators six to eighteen months into a CTEM program. The change is real. The change is also not free. We will get to that at the end.
Eight things you said. Eight things they said.
01 · The CVSS queue.
02 · The Sunday phone call.
03 · The IT ops fight.
04 · The board metric.
Eight things you said. Eight things they said.
05 · The audit room.
06 · The breach call.
07 · The team.
08 · The Monday spreadsheet.
The shift is not free. It is also not optional.
Read the right-hand column again. Notice what is not there. It is not "I bought a new tool." It is not "I hired six more engineers." It is not "the auditor went away." The auditor is still there. The tools are mostly the same. The team is the same size, sometimes smaller.
What changed is the operating model. Aggregation across feeds, not one scanner output. Validation before remediation, not blind closure. Reachability as the prioritization spine, not CVSS alone. Mobilization measured by outcome, not activity. The CTEM phases (Scope, Discover, Prioritize, Validate, Mobilize) replacing the queue with a loop. None of this is new. Gartner formalized it years ago. Most teams have just never made the shift, because the cost looks high until you realize the cost of not shifting is higher.
What the shift actually costs
Six to twelve weeks of reorganization. A change in board metrics. A documented risk-based exception process to defend in front of auditors. The willingness to suppress, with justification, the CVSS findings that cannot reach. Some uncomfortable conversations with QSAs and Big Four assessors who have not yet caught up. That is the bill. It is not nothing. It is also a small fraction of what the patch tax is costing you right now.
The right column is not aspirational. It is what the shift produces. I have watched dozens of teams cross that line. None of them want to go back.
Forty-five minutes. The same conversation, but on the record.
If we walked through your current VM program against the eight pairs in this brief, where would your team's quotes land: left column or right column? I will work with your VM lead to map it. No deck. No demo. Just the dual-life inventory and a 90-day plan to move the quotes from left to right.
.svg)