Everyone Has Visibility. Almost Nobody Has Confidence.

https://www.cybersecurity-insiders.com/everyone-has-visibility-almost-nobody-has-confidence/

Publish Date: 2026-07-13 11:25:00

Source Domain: www.cybersecurity-insiders.com

Author:

Using an unordered list, summarize the following article with between 4 and 8 key points.

Security analysts are burning two full working days a week chasing threats that don’t matter. Not because they lack tools, but because they have too many.
That was the finding that stood out to me in our recent State of Threat Management report, a survey of 550 security experts worldwide. Those two days represent the cost of uncertainty. Ninety-seven percent of respondents still can’t reliably tell which exposures are exploitable, and nearly six in ten don’t have a consolidated view of their own cyber risk. When everything looks urgent, teams end up chasing everything.
What concerns me even more is what gets missed in the process. Eighty-four percent of respondents said the attacks targeting them exploited risks that were already known. These weren’t zero-days or novel techniques. They were threat exposures someone inside the company had already identified, but the warning never reached the person who could act in time.
We’ve spent a decade making security more visible: better threat intelligence platforms, better attack-surface monitoring, better cloud-posture tooling. By that measure, the industry has won. Why are attackers still walking through doors we already knew were unlocked?
Security Teams Don’t Need More Data
Faced with that uncertainty, the instinct is often to buy another tool or subscribe to another threat feed. Our data suggests that’s solving the wrong problem. Most organizations we surveyed already run dozens of security products, each producing real information about a different slice of the infrastructure. Most of that data sits in isolation, and isolated data, however good, can’t tell you which risks matter.
That’s why, when we asked what mattered most in choosing an exposure management platform, integration topped the list, ahead of accuracy, automation, and cost. That’s consistent with what we hear from customers.
They aren’t looking for another dashboard. They’re looking for the systems they already have to work together. When those signals are connected, they start to support a threat-informed defense. Left in silos, they’re just more information for analysts to sort through.
The regional split makes the stakes concrete. Just over half of North American organizations report a consolidated view of their risk. In the UK and Singapore, that figure falls to 24%. Different maturity levels, same underlying gap: the information exists, but it hasn’t been connected into anything a team can trust.
A CISO Told Me His Threat Intelligence Was Worthless. He Was Half Right.
A CISO I met at a conference recently told me, flatly, that his team got no value from threat intelligence. I pushed back, and it took us a few minutes to realize we were talking about two different things. He meant raw threat feeds: the endless stream of indicators and alerts. I meant what happens downstream, once those feeds are enriched with context, wired into other systems, and turned into something a person can act on.
He had a point. A threat feed by itself is just another stream of information. It only becomes useful once it’s enriched with context, connected to the rest of your environment, and tied to decisions people can make. Without that, you’ve added another source of alerts instead of reducing uncertainty. That’s what gives security teams confidence that they’re acting on the right risks instead of reacting to more information.
The Real Failure Is Between Teams, Not Within Them
That’s why I don’t see this as a visibility problem. It’s a coordination problem. In many cases, organizations already had the information they needed to stop an attack. It just wasn’t reaching the people who needed to act on it.
Every security function is doing valuable work. Threat intelligence teams gather and analyze intelligence. Threat hunters investigate adversary activity. Red and blue teams validate defenses, while risk teams decide what gets fixed first. The challenge is making sure those efforts inform one another. What we’re looking for is a chaining effect, where contextualized intelligence flows into a continuous cycle of assessment, validation, and remediation.
Does what the intel team learns on Monday change what the hunters do on Tuesday? Too often, it doesn’t. By the time a serious issue climbs high enough to reach executive leadership, it’s been stripped down to something too technical to act on, disconnected from the operational picture that would have made it urgent.
Threat-informed defense comes down to one requirement: that intelligence moves, shaping what each team does next instead of dying quietly inside the team that produced it.
AI Buys Back Time
We ran this research before the current wave of frontier AI tools, and even then, organizations were pointing toward automation.
Today, organizations use AI in roughly 37% of exposure management processes, and respondents expect that to reach 59% within two years.
That shift makes sense because the clock works against defenders. The window between a vulnerability’s disclosure and its exploitation keeps shrinking, while the volume of data teams have to assess keeps growing. Manual triage can’t keep pace with both at once.
AI isn’t a universal fix, any more than another threat feed was. Where it has real value is in processing huge volumes of exposure data, identifying what’s realistically exploitable, and helping analysts decide what deserves attention first. Human judgment is still essential. AI helps teams reach that judgment faster.
Confidence Becomes the Advantage
The uncomfortable takeaway from this research is that almost none of these organizations are starting from zero. They already have the data, the visibility, and the skilled people. What they lack is confidence that all of it is working together to produce the right call at the right moment.
The organizations that succeed won’t necessarily be the ones collecting the most intelligence. They’ll be the ones that can connect threat intelligence, exposure data, and prioritization into a single decision-making process.
Chances are, the information needed to stop the next breach already exists somewhere inside the organization. Whether it gets to the right people in time is what ultimately determines the outcome.