The vulnerability management gap no one talks about – Source: go.theregister.com

Partner content Recently, I’ve been diving deep into security control data across dozens of organizations, and what I’ve found has been both fascinating and alarming. Most security teams I work with can rattle off their vulnerability management statistics with confidence. They know their scan schedules, their remediation timelines, and their critical vulnerability counts. They point to clean dashboards and comprehensive reports as proof that their programs are working.

But there’s something teams don’t realize. It’s common for us to find between 0.5 and one percent of an organization’s devices missing EDR, between one and three percent with EDR health issues, and between three and five percent missing their endpoint management tools. What has come as the biggest surprise is the 10-20 percent of devices that have never had a vulnerability scan.

One or two in every ten devices have never been properly scanned for vulnerabilities. Yet the dashboards look clean. The reports show healthy coverage. Leadership operates with a false sense of security that everything is accounted for.

This doesn’t happen because security teams are negligent or their tools are broken. It happens because vulnerability management is more complex than most platforms make it appear. And the gaps aren’t visible until you know where to look.

Why your scans miss more than you think

Organizations investing in enterprise vulnerability management platforms often believe they’ve solved the visibility issue. They expect comprehensive coverage, but significant gaps can still exist. These gaps fall into two main categories:

• Devices are not visible on the network

If a device isn’t connected to the network, it’s invisible. Detecting these assets requires them to be available for scanning, appear in another tool, or become visible through user logins to managed apps or systems. Without these triggers, these devices remain undetected.

• Devices are on the network, but lack an agent

Many devices are present on the network. You can ping them or run port scans. However they still lack vulnerability agents or credentials for a complete scan. This creates a large portion of the visibility gap, as these devices remain partially assessed. Vulnerabilities in their applications, operating systems, or configurations go unaccounted for.

The problem isn’t just about invisibility. Remote users, firewalled devices, and unmanaged endpoints add to the challenge. But even for devices discovered through basic scans, the lack of deeper insights into vulnerabilities leaves critical blind spots. Visibility requires more than just surface-level discovery; it demands thorough agent- or credential-based assessments to truly understand the risks present in your environment.

No native view of never-scanned devices

Another common challenge with vulnerability management platforms is their lack of a native feature to highlight assets that have never been scanned. Identifying these devices often requires running separate discovery scans and filtering for unassessed assets. However, this only works if administrators configure discovery scans and know how to correlate the data.

These design decisions prioritize scanning efficiency over complete visibility. They leave gaps in your environment that are invisible by design, not by accident.

What these gaps actually cost you

These platform limitations lull security teams into a false sense of completeness. They run regular scans, see clean dashboards, and assume everything is covered. In reality, some devices have never been scanned, others are missing agents, authenticated scans have silently failed and defaulted to lightweight assessments, and entire network segments or cloud zones are excluded from scope.

I’ve seen this play out in painful ways. One financial services company discovered during an incident response that their breach originated from a server that hadn’t been scanned in eight months. Its vulnerability dashboard showed 98% coverage because the server wasn’t in the system’s inventory. A healthcare organization found that 15% of its workstations in satellite offices were running unpatched software. Connectivity issues on its network caused scans to fail silently, with no alerts generated.

Downstream effects cascade quickly when critical vulnerabilities remain undetected. Patch management programs operate on incomplete data. Compliance audits become exercises in hope rather than verification. When executives ask “Are we protected against this new threat?” the honest answer should often be “We don’t know what we don’t know.”

How you can pinpoint the gaps in your vulnerability scans

I’m convinced that most organizations are approaching vulnerability management backwards. We’ve all grown used to trusting vendor dashboards and native reporting, but that platform-native visibility is often insufficient for comprehensive coverage validation.

The solution isn’t to abandon these tools. They’re still essential for the scanning and assessment work they do well. Instead, teams need a source-agnostic approach that continuously validates coverage by aggregating inventory data across multiple systems.

Here’s what I’ve seen work. Organizations that maintain continuously updated asset inventories focus on three key comparisons:

• Compare all known devices to recently scanned devices.

• Identify which assets lack full, authenticated scans in the last 14 days.

• Highlight misconfigurations, missed IP addresses, and agentless devices.

This requires pulling data from EDR platforms, endpoint management tools, asset discovery systems, and vulnerability scanners, then correlating that information to identify discrepancies. It’s not trivial work, but it’s the only way I’ve found to get an accurate picture of actual coverage versus reported coverage.

It’s worth the effort. The organizations that have implemented this approach consistently discover significant gaps they didn’t know existed. More importantly, they can proactively address those gaps rather than discovering them during incidents or audits.

Correlating this data across multiple sources and identifying coverage gaps has been one of the core problems we’ve been solving at Prelude. Regardless of the tool you use, the real takeaway is that platform-native reporting simply isn’t enough.

Continuous validation is key

If you’re running a vulnerability management program, here’s my recommendation: Stop trusting your vulnerability platform to tell you what you’re missing. By design, these tools can’t show you devices they’ve never seen.

Start by conducting a comprehensive inventory audit. Pull device lists from your EDR, your endpoint management platform, your network discovery tools, and your DHCP servers. Cross-reference this against your vulnerability scanner’s asset inventory. The discrepancies will likely surprise you.

Then implement ongoing monitoring to catch new gaps as they emerge. In dynamic environments, devices come and go, network configurations change, and agents fail. Point-in-time assessments become outdated the moment you complete them. You need continuous validation that alerts you when devices fall out of scanning scope or when authentication failures cause scans to degrade silently.

Finally, know the limitations of vendor-provided coverage metrics as your primary indicator of program health. Sure, these metrics can be valuable, but they’re measuring what the platform can see, not what exists in your environment.

The gaps are there. The question is whether you’ll find them before someone else does.

Contributed by Prelude Security