{"id":49260,"date":"2022-11-11T15:00:00","date_gmt":"2022-11-11T15:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/vulnerabilities-threats\/why-cve-management-as-a-primary-strategy-doesn-t-work"},"modified":"2022-11-11T15:00:00","modified_gmt":"2022-11-11T15:00:00","slug":"why-cve-management-as-a-primary-strategy-doesnt-work","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/","title":{"rendered":"Why CVE Management as a Primary Strategy Doesn&#8217;t Work"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltf2821c0cd5d0e509\/62683a55b96bc56d125d0d85\/cybersecurity-Stu_Gray-2GN9BH6-Alamy-CP.jpg\" class=\"ff-og-image-inserted\"><\/div>\n<p>As a security researcher, common vulnerabilities and exposures&nbsp;(CVEs) are an issue for me \u2014 but not for the reason you might think.<\/p>\n<p>While IT and security teams dislike CVEs because of the threat they pose and the mountain of remediation work they create for them, what troubles me is the way our modern security procedures relate to CVEs. Our mitigation strategies have become too focused on &#8220;vulnerability management&#8221; and are too CVE-centric, when what we really need is a hacker-centric approach to effectively reduce our exposure.<\/p>\n<p>Vulnerability management as a primary strategy doesn&#8217;t really work. According to the National Institute for Standards and Technology, <a href=\"https:\/\/nvd.nist.gov\/general\/visualizations\/vulnerability-visualizations\/cvss-severity-distribution-over-time\" target=\"_blank\" rel=\"noopener\">20,158 new vulnerabilities<\/a> were discovered in 2021 alone. This represented the fifth consecutive year of record numbers for vulnerability discovery, and it looks like 2022 may very well continue the trend. Security teams cannot reasonably patch 20,000 new vulnerabilities a year, and even if they could, they shouldn&#8217;t.<\/p>\n<p>This might sound counterintuitive, but there are a few reasons why it&#8217;s not. The first is that recent research reveals that only about 15% of vulnerabilities are actually exploitable, and so patching every vulnerability is not an effective use of time for security teams that have no shortage of tasks. The second and equally important reason is that even if you did continuously patch 100% of the CVEs in your network, this likely still wouldn&#8217;t be effective at stopping hackers.<\/p>\n<h2 class=\"regular-text\">Hacker Strategies Are Vast and Varied<\/h2>\n<p>Phishing, <a href=\"https:\/\/www.darkreading.com\/application-security\/ducktail-spearphishing-linkedin-hijack-facebook-business-accounts\" target=\"_blank\" rel=\"noopener\">spear-phishing<\/a>, varying levels of social engineering, leaked credentials, default credentials, unauthenticated access using standard interfaces (FTP, SMB, HTTP, etc.), accessible hotspots with no passwords, network poisoning, password cracking \u2014 the list of strategies that hackers are employing is vast and varied, and many don&#8217;t even require a high-level CVE, or any CVE at all, to be dangerous to an organization. The <a href=\"https:\/\/www.csoonline.com\/article\/3674209\/uber-links-cyberattack-to-lapsus-says-sensitive-user-data-remains-protected.html\" target=\"_blank\" rel=\"noopener\">recent Uber breach<\/a> is an excellent example of how hackers exploited an organization without utilizing the latest CVEs or overly complicated attack methods to target organizations.<\/p>\n<p>Depending on whether you believe what the hacker <a href=\"https:\/\/www.nytimes.com\/2022\/09\/15\/technology\/uber-hacking-breach.html\" target=\"_blank\" rel=\"noopener\">claimed on Uber&#8217;s Slack channel<\/a><u>,<\/u> or <a href=\"https:\/\/www.reuters.com\/business\/autos-transportation\/uber-says-hacker-working-with-lapsus-responsible-cybersecurity-incident-2022-09-19\/\" target=\"_blank\" rel=\"noopener\">Uber&#8217;s recent comments<\/a>, the hacker was either an 18-year-old who exfiltrated data from an Uber staffer via a clever social-engineering\/spear-phishing attack, or the work of South American hacking group Lapsus$, which executed a spear-phishing attack, utilizing the leaked credentials of a third-party contractor obtained from the Dark Web. In either scenario, there was no complicated coding or vulnerability exploitation that went on here. Instead, it was a variation on an old-school tactic that is tried and true.<\/p>\n<h2 class=\"regular-text\">It&#8217;s Not The Vulnerability but the Vector That Matters<\/h2>\n<p>I don&#8217;t want anyone to get the wrong idea. Patching is very important; it&#8217;s a critical part of a strong security posture, and a crucial component of every security strategy. The issue is that many tools today prioritize remediation recommendations based solely on Common Vulnerability Scoring System (CVSS) scores, and what gets lost is the organizational context; the understanding of how to separate the meaningful 15% of vulnerabilities from the other 85%.<\/p>\n<p>As an experienced penetration tester in the Israeli Defense Forces and vice president of research, leading a team of ex-pen testers and red teamers at Pentera, what I&#8217;ve learned is that it&#8217;s not the vulnerability but the vector that matters. Just because your attack doesn&#8217;t begin with a major vulnerability doesn&#8217;t mean it won&#8217;t end with one. The most dangerous vulnerability to your organization might be a 5.7\/10 CVSS score hidden at the bottom of a list of high-scoring false positives.<\/p>\n<h2 class=\"regular-text\">Leaked Credentials Are a Bigger Threat<\/h2>\n<p><a href=\"https:\/\/www.darkreading.com\/application-security\/microsoft-exchange-autodiscover-flaw-leaks-thousands-of%20credentials\" target=\"_blank\" rel=\"noopener\">Leaked credentials<\/a> likely pose a far greater threat to the average organization than the next dozen CVEs to be announced combined, yet many organizations have no protocol in place to discover if any of their credentials are floating around in the darker parts of the Web. We act as if hackers will spend countless hours developing new CVEs, while they are really just looking for the most efficient way to access our networks. Many of today&#8217;s hackers, and hacking groups, are financially motivated, and like any organization they want the best ROI for their time. Why spend time executing a complicated attack when you can just buy or scrape the credentials?<\/p>\n<p>Right now, our defenses aren&#8217;t working, and we, as security professionals, need to reexamine where the weak points are. While vulnerability management is definitely a core part of any meaningful security strategy, we need to move away from it as a primary methodology. Instead, we need to take a good look at the strategies hackers are utilizing and base our security strategies on how to stop them. If we want our security to actually be effective toward reducing our exposure, our strategies must focus on understanding the real-world techniques and methodologies that hackers are using to exploit us.<\/p>\n<p>Read More <a href=\"https:\/\/www.darkreading.com\/vulnerabilities-threats\/why-cve-management-as-a-primary-strategy-doesn-t-work\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>With only about 15% of vulnerabilities actually exploitable, patching every vulnerability is not an effective use of time. Read More <a href=\"https:\/\/www.darkreading.com\/vulnerabilities-threats\/why-cve-management-as-a-primary-strategy-doesn-t-work\">HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-49260","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Why CVE Management as a Primary Strategy Doesn&#039;t Work 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why CVE Management as a Primary Strategy Doesn&#039;t Work 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-11-11T15:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltf2821c0cd5d0e509\/62683a55b96bc56d125d0d85\/cybersecurity-Stu_Gray-2GN9BH6-Alamy-CP.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-cve-management-as-a-primary-strategy-doesnt-work\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-cve-management-as-a-primary-strategy-doesnt-work\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Why CVE Management as a Primary Strategy Doesn&#8217;t Work\",\"datePublished\":\"2022-11-11T15:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-cve-management-as-a-primary-strategy-doesnt-work\\\/\"},\"wordCount\":816,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-cve-management-as-a-primary-strategy-doesnt-work\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltf2821c0cd5d0e509\\\/62683a55b96bc56d125d0d85\\\/cybersecurity-Stu_Gray-2GN9BH6-Alamy-CP.jpg\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-cve-management-as-a-primary-strategy-doesnt-work\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-cve-management-as-a-primary-strategy-doesnt-work\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-cve-management-as-a-primary-strategy-doesnt-work\\\/\",\"name\":\"Why CVE Management as a Primary Strategy Doesn't Work 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-cve-management-as-a-primary-strategy-doesnt-work\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-cve-management-as-a-primary-strategy-doesnt-work\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltf2821c0cd5d0e509\\\/62683a55b96bc56d125d0d85\\\/cybersecurity-Stu_Gray-2GN9BH6-Alamy-CP.jpg\",\"datePublished\":\"2022-11-11T15:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-cve-management-as-a-primary-strategy-doesnt-work\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-cve-management-as-a-primary-strategy-doesnt-work\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-cve-management-as-a-primary-strategy-doesnt-work\\\/#primaryimage\",\"url\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltf2821c0cd5d0e509\\\/62683a55b96bc56d125d0d85\\\/cybersecurity-Stu_Gray-2GN9BH6-Alamy-CP.jpg\",\"contentUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltf2821c0cd5d0e509\\\/62683a55b96bc56d125d0d85\\\/cybersecurity-Stu_Gray-2GN9BH6-Alamy-CP.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-cve-management-as-a-primary-strategy-doesnt-work\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Why CVE Management as a Primary Strategy Doesn&#8217;t Work\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Why CVE Management as a Primary Strategy Doesn't Work 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/","og_locale":"en_US","og_type":"article","og_title":"Why CVE Management as a Primary Strategy Doesn't Work 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-11-11T15:00:00+00:00","og_image":[{"url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltf2821c0cd5d0e509\/62683a55b96bc56d125d0d85\/cybersecurity-Stu_Gray-2GN9BH6-Alamy-CP.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Why CVE Management as a Primary Strategy Doesn&#8217;t Work","datePublished":"2022-11-11T15:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/"},"wordCount":816,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltf2821c0cd5d0e509\/62683a55b96bc56d125d0d85\/cybersecurity-Stu_Gray-2GN9BH6-Alamy-CP.jpg","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/","url":"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/","name":"Why CVE Management as a Primary Strategy Doesn't Work 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltf2821c0cd5d0e509\/62683a55b96bc56d125d0d85\/cybersecurity-Stu_Gray-2GN9BH6-Alamy-CP.jpg","datePublished":"2022-11-11T15:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/#primaryimage","url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltf2821c0cd5d0e509\/62683a55b96bc56d125d0d85\/cybersecurity-Stu_Gray-2GN9BH6-Alamy-CP.jpg","contentUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltf2821c0cd5d0e509\/62683a55b96bc56d125d0d85\/cybersecurity-Stu_Gray-2GN9BH6-Alamy-CP.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/why-cve-management-as-a-primary-strategy-doesnt-work\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Why CVE Management as a Primary Strategy Doesn&#8217;t Work"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/49260","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=49260"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/49260\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=49260"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=49260"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=49260"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}