Microsoft security researchers analyzed real-world attack data and found that exploited vulnerabilities concentrate in a small, high-impact subset of CVEs. The study shows defenders can dramatically reduce risk by prioritizing vulnerabilities based on exploitation likelihood, internet exposure, and potential blast radius instead of trying to patch everything.
Exploitation Concentrates in a Tiny CVE Fraction
Microsoft's analysis of real-world attack telemetry reveals that active exploitation targets only a small percentage of published CVEs. The data shows threat actors consistently gravitate toward vulnerabilities that offer reliable exploitation paths, high-value targets, and broad deployment across organizations. This concentration means defenders facing thousands of new CVEs each year can focus their limited remediation resources on the fraction that actually gets weaponized.
The research identifies three key factors that predict whether a vulnerability will see active exploitation: the likelihood of exploitation based on weaponization complexity, the exposure of vulnerable systems to internet-accessible attack surfaces, and the potential blast radius if compromise occurs. Vulnerabilities scoring high across all three dimensions account for the vast majority of observed exploitation activity in Microsoft's telemetry.
This finding challenges traditional vulnerability management approaches that prioritize based solely on CVSS severity scores. A critical-rated vulnerability with complex exploitation requirements and limited exposure may pose less actual risk than a high-rated flaw in an internet-facing service with trivial exploit code available. The data-driven approach shifts focus from theoretical severity to observed exploitation patterns.
Prioritization Framework for Defenders
Microsoft recommends a three-pillar prioritization framework that weighs exploitation likelihood, exposure, and blast radius. Exploitation likelihood considers whether proof-of-concept code exists, whether the vulnerability is actively targeted by known threat groups, and the technical complexity of reliable exploitation. Exposure evaluates whether vulnerable systems are internet-facing, accessible via phishing or lateral movement, or isolated in segmented networks.
Blast radius assessment examines what an attacker gains upon successful exploitation: domain admin credentials, sensitive data access, persistence mechanisms, or lateral movement pathways. Vulnerabilities that score high across all three pillars — such as remote code execution in internet-facing VPN appliances or authentication bypasses in identity systems — should receive immediate patching attention regardless of their CVSS rating.
The framework also accounts for compensating controls that reduce effective risk. Network segmentation, multi-factor authentication, endpoint detection and response, and zero trust architectures can lower the blast radius or exposure of vulnerable systems, allowing defenders to sequence remediation more strategically rather than treating every high-severity CVE as an equal emergency.
Operationalizing Data-Driven Vulnerability Management
Security teams can operationalize this approach by integrating threat intelligence feeds that track active exploitation, asset inventories that map internet exposure, and business impact assessments that quantify blast radius. Microsoft Defender Vulnerability Management and similar tools now surface exploitation likelihood signals alongside traditional severity scores, enabling automated prioritization that aligns with real-world threat activity.
Organizations should establish a recurring review cadence — weekly for internet-facing critical assets, monthly for internal systems — to reassess priorities as new exploitation evidence emerges. This replaces the common quarterly or annual vulnerability scan cycle with a threat-informed rhythm that matches attacker speed. The goal is not perfect coverage but continuous reduction of the exploitable attack surface.
Microsoft emphasizes that this data-driven approach complements, not replaces, foundational hygiene: timely patching, secure configuration, least privilege access, and monitoring for post-exploitation activity. The prioritization framework helps teams decide what to patch first when resources are constrained, while baseline hygiene reduces the likelihood that any single vulnerability leads to catastrophic compromise.
What to do next
Start by mapping your internet-facing assets and cross-referencing them against CVEs with known active exploitation. Use Microsoft Defender Vulnerability Management or equivalent tooling to surface exploitation likelihood signals, then apply the three-pillar framework to sequence remediation. Review priorities weekly for external attack surfaces.
Source: What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks (Azure).
