The Future of IT Controls

Not proving we patched everything. Proving attackers cannot easily reach what matters.

FromFind everything. Fix everything. Validate it. → ToBreak the paths. Reduce the risk. Continuously validate it.

1. The problem: the queue never ends

Finding count is not risk. Attackers need one path.

Why the queue never ends

Structural, not effort

Why it keeps expanding

NVD moved to triage, April 2026¹

Why patching is not the fix

The bottleneck sits elsewhere

Enrichment now covers 15–20 percent of incoming CVEs.¹ The prioritization work NIST stopped doing moved to your backlog.

2. Think like the attacker

Attackers traverse a graph. Every path is a chain, and a chain fails at its cheapest link.

Think like the attacker: attack graph

How one path is built

Key insight

20,000 vulnerabilities may collapse into a few dozen meaningful attack paths. Break the right paths, not everything.

Break attack paths, not just patches

There are many ways to break a path

BREAK ANY LINKPath becomes infeasible

Risk-based prioritization

Focus on what matters most

↓

Remediation priority

Patching is one of eight interventions, and often the most expensive. Reachability alone removes most noise: 84 percent of SCA alerts sit on dependencies the application never calls.⁸

3. Modernize controls: from activity to outcome

Same objectives. Different evidence.

Modernize controls

Outdated (activity) → modern (risk-based, continuous)

Exceptions done right

Six questions, answered in writing

Managed exceptions are risk treatments. Unmanaged exceptions are incidents waiting to happen.

4. Make it easier with AI — not just automation

Automation runs a rule you wrote. AI handles the work between rules: correlating, summarizing, translating, drafting.¹⁶

Make it easier with AI

Find and decide faster

…and easier to audit

Translate and evidence

Not this

No model accepts risk, closes a finding, approves privileged access, or signs an assertion.

5. Auditable, practical, actionable

Six steps, each producing the evidence for the next.

The operating model

Control execution emits the evidence^11,13

Measure the queues

Then remove them

The patch is rarely the problem. The queues are.

The first 90 days

In order — each enables the next

Queue times are an illustrative enterprise cadence. Two steps consume 14 of 16 days, and neither is technical.

6. Conclusion

Find everything and fix everything broke when supply outran capacity. No tooling restores it.

Know the estate. Compute the paths. Break the cheapest link. Let the control emit its own proof. You are not claiming zero findings — you are showing the remaining ones do not connect to anything that matters.

THE FUTURE OF IT CONTROLS

Not proving we patched everything. Proving attackers can't easily reach what matters.