Securing What Matters: Why Cyber Resilience Needs Prioritisation

Summary

UK businesses experienced an estimated 5.19 million cybercrimes in the past year, averaging over 14,000 incidents daily, overwhelming stretched security teams. The article argues for an intelligence-led approach to vulnerability prioritization, moving beyond CVSS scores to consider real-world risk, exploitation signals, and threat actor activity to effectively allocate resources against evolving threats, including those amplified by AI.

Full text

Recent government data shows the scale of cyber threats facing security teams. According to the Cyber Security Breaches Survey 2025/2026, it’s estimated that UK businesses experienced 5.19million cyber crimes in the last 12 months. This means an average of over 14,000 incidents per day. The volume and frequency of threats show little sign of slowing. IT Security Guru recently reported a 34% increase in cyber attacks in June, compared with the same month last year. Every day seems to bring new vulnerabilities, new alerts and new attacks, compounding a mounting challenge for teams operating with stretched resources and budgets. Threats are intensifying, while security teams are tracking thousands of vulnerabilities across on-premises infrastructure, cloud environments and increasingly complex supply chains. While organisations continue to invest in cyber defences, the reality is that security teams cannot patch every vulnerability or investigate and act on every threat. Adversaries understand this imbalance and are increasingly exploiting it. Rather than relying solely on sophisticated attach techniques, many threat actors are attempting to hit businesses from every direction by increasing the volume, speed and frequency of attacks. The aim is to overwhelm security teams and misdirect their attention through a constant stream of alerts, vulnerabilities and incidents. Attackers can then, in theory, concentrate on a successful breach that flies under the radar. Artificial Intelligence (AI) is being leveraged by cyber criminals to evolve this form of attack. LLMs can be used to accelerate reconnaissance of targets, amplify deception and social engineering, and significantly cut the time between vulnerability disclosure and working exploit. The expansion of cybercrime-as-a-service ecosystems are also lowering the barriers to entry for less-skilled adversaries and further contributing to a trend of faster, smaller, harder-to-disrupt attacks. Faced with a relentless avalanche of cyber attacks, security teams must accept the uncomfortable truth that not every vulnerability matters equally. A key step for achieving this is building an intelligence led approach to vulnerability prioritisation, shifting beyond an over-reliance on Common Vulnerability Scoring System (CVSS) scores to manage risk. Many businesses rely heavily on CVSS ratings to organise patching and remediation priorities. And, although CVSS remains a useful measure of technical severity, it doesn’t tell security teams whether a vulnerability is actually being targeted by threat actors. There may be instances, for example, where a vulnerability receives a critical score, but it isn’t being actively being exploited or lined up in a threat actor’s crosshairs. The consequence of this can be that fixes are made to what’s deemed a critical threat, whilst an adversary is weaponising a lower-rated vulnerability that’s not high up the list of priorities for remediation. Rather than focusing solely on severity ratings, organisations need to assess vulnerabilities according to real-world risk. This means having the ability to combine exploitation signals, threat actor activity, ransomware group associations and specific tech stacks to effectively surface the CVEs that actually require attention. Essentially, security teams can utilise cyber threat intelligence to build an understanding of whether adversaries are actively discussing or weaponising vulnerabilities to prioritise where they direct their resources and mitigation efforts. The businesses getting ahead of attackers are those breaking a reactive cycle of vulnerability patching. They are increasingly adopting intelligence-led strategies to effectively determine where a vulnerability sits in the exploitation lifecycle to take action before attackers can take advantage. Threat intelligence also enables automation and the foundations for embracing AI to prioritise vulnerability remediation at machine-speed. By continuously ingesting exploitation signals, monitoring threat actor activity and correlating insights against an organisation’s tech stack, teams can significantly reduce the manual effort for triaging vulnerabilities. This can prove beneficial for evolving from reactive patching to proactive risk reduction. Ultimately, cyber resilience is no longer about trying to fix everything. It’s about fixing what matters most in a timely way, before attack intent becomes a breach. Vulnerability prioritisation is crucial to this and can enable security teams to consistently identify and address the highest-risk cyber threats. By Alexander Leslie, Senior Advisor at Recorded Future

Entities