Recent research paints a sobering picture of enterprise security, says Dan Schiappa, President of Technology and Services, at the cyber firm Arctic Wolf.
Across more than 800,000 IT assets, 33 per cent are missing at least one critical security control, nearly one in five resources have reached their end-of-life, and 17pc sit entirely outside traditional vulnerability management tools. Although the main concern for security teams is often zero-day vulnerabilities and sophisticated cyber threats, the more immediate danger is the risks they already know about,but havenโt yet fixed. The modern attack surface is not just expanding โ it is becoming increasingly misunderstood, disconnected and difficult to maintain control over.
Known vulnerabilities, not novel techniques
Oftentimes, attackers are not outpacing defenders technologically. They are taking advantage of execution gaps. Instead of constantly innovating to create novel attack methods, threat actors are looking for the easy in. Research has found that every one of the top tenย most frequently exploited vulnerabilities in recent incident response cases had already been patched by vendors โ often months earlier.
At the same time, 65 per centย of incidents involved the abuse of remote access services such as VPNs, RDP and remote management tools. These are not obscure weaknesses; they are foundational components of IT. What this reveals is organisations have become adept at identifying vulnerabilities, but far less effective at prioritising and remediating them. The gap between knowing, prioritising and fixing issues is where risk accumulates, and as the gap grows, so does the likelihood of breaches.
Legacy systems are a persistent challenge
Another major challenge is the persistence of legacy technology. 19% of IT assets are running software or hardware that has reached end-of-life, meaning it no longer receives security updates.
These systems are particularly challenging. In sectors such as financial services, healthcare and manufacturing, they are often embedded in critical processes and cannot be easily replaced. Yet they remain permanently exposed to known vulnerabilities. It is not unusual for organisations to believe legacy systems have been decommissioned โ only to discover they were still active. This creates a persistent blind spot within the attack surface, one that attackers are quick to exploit. The problem is not just their existence, but their opacity.
Systems cannot be secured without visibility
Enterprise IT environments now span on-premises infrastructure, cloud services, SaaS applications, remote endpoints and third-party integrations. These highly distributed ecosystems have created a fundamental challenge: visibility. Different tools typically manage each system layer, each maintaining its own inventory. Organisations often donโt have a unified view across layers and the result is predictable. Entire systems go unscanned. Assets fall outside patch cycles. Devices are not covered by endpoint protection. Almost a fifth of assets are now not covered by vulnerability management tools at all โ effectively rendering them invisible from a security standpoint.
Organisations cannot secure what they cannot see and this is not simply a technical oversight. It creates what many security leaders now recognise as a structural weakness. For UK businesses, this challenge is becoming increasingly consequential. Regulatory frameworks such as the Network and Information Systems (NIS2) Regulations โ and the UKโs upcoming Cyber Security and Resilience Bill โ are placing greater emphasis on demonstrable control over assets and risk. Inaccurate inventories and fragmented data make that increasingly difficult to prove.
The gap between knowledge and resilience
Across the UK and EU, frameworks such as the Digital Operational Resilience Act in financial services and NIS2 more broadly are raising expectations for cyber resilience. Organisations are no longer judged on whether controls are in place, but whether they are effective, verifiable and consistently applied.
One major concern is the extent to which organisations misunderstand their own security posture. Many rely on a single system of record โ such as a configuration management tool as their โsource of truthโ. However, these systems are often incomplete. In some instances, independent analysis has revealed that a portion of a companyโs devices were not included in a security system at all, despite it believing it had full endpoint protection coverage based on internal reporting. This disconnect between perception and reality creates a false sense of security โ one that is increasingly untenable in a climate of rising regulatory scrutiny and board-level accountability.
A holistic approach to exposure management
The biggest challenge for organisations is not a lack of data, but a lack of clarity about what matters most. Against this backdrop, there is a broader shift in how organisations approach cybersecurity. Traditional vulnerability management, focused on identifying and scoring flaws, is no longer sufficient.
Exposure management, by contrast, adopts a more holistic view. It combines continuous asset discovery with data from multiple sources, applying business and threat context to prioritise risk. Crucially, it also focuses on verification โ ensuring that remediation actions are actually completed. Organisations that adopt more mature exposure management practices are already seeing results, with reductions of more than 40% across key risk categories, including missing controls and end-of-life assets.
Systematic, continuous and scalable cyber resilience
As cyber risk becomes more tightly linked to regulatory compliance, insurance requirements and board-level governance, cybersecurity is no longer just about defending against the unknown. The ability to demonstrate control over the attack surface โ to prove what exists, how it is protected and whether risks have been reduced โ is fast becoming a baseline expectation. Attackers are now able to achieve domain-wide control in minutes once inside an environment. In that context, delays in remediation or gaps in visibility are not just critical business risks. For UK organisations, reducing exposure is now about managing known vulnerabilities systematically, continuously and at scale.
Ultimately, in todayโs threat landscape, the greatest risk is not what organisations donโt yet knowโ it is what they already know, but havenโt fixed. The organisations that will succeed are those that close the gap between insight and action. Those that move beyond assumptions and develop a clear, verifiable understanding of their exposure.
