Qualys CISO urges tracking exposure window over MTTR
Original title: Qualys CISO on what security teams can do as exploit campaigns grow
Qualys TRU says 357 of 48,172 flaws disclosed in 2025 were remotely exploitable and weaponized.
In a Help Net Security interview, Qualys CISO Nathan Smolenski says teams should measure the average window of exposure rather than disclosure-based MTTR. He cites Anthropic’s Glasswing finding more than 6,000 high or critical issues in 1,000 open-source packages and Mozilla finding 22 issues in Firefox. Qualys Threat Research Unit reports 357 of 48,172 vulnerabilities disclosed in 2025 were remotely exploitable and actively weaponized, or 0.74 percent. He says accountability for automated remediation decisions stays with the company.
Unconfirmed: Figures come from the interviewee and cited research, not independently verified here.
- FIRST expects about 66,000 vulnerabilities reported this year, Smolenski says.
- He describes hyper-prioritization as real-time decisions rather than monthly spreadsheets.
- Chained flaws can turn previously low-risk issues into remote code execution.
- The interview is cut off while discussing supervised remediation and rollback.
From the original article
7 min read at helpnetsecurity.com
In this Help Net Security interview, Nathan Smolenski, CISO at Qualys, talks about how security teams can handle the growing volume of AI-discovered vulnerabilities. He explains why CISOs should track the average window of exposure instead of standard MTTR, and why only a small share of disclosed flaws, under one percent in 2025, pose active risk.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.