At it-sa 2026, Check Point’s Daniel Dreier argues that score-driven patching has run its course. Continuous, context-based exposure management is taking its place.
Companies have spent years working through vulnerability lists ordered by rigid scores. Highly networked, hybrid infrastructures and automated attack methods now force a rethink. Continuous, context-based management of the entire attack surface is moving to the center of modern defense, says Daniel Dreier, who heads Exposure Management for the DACH region at Check Point Software Technologies, in an interview at it-sa 2026.
IT security is undergoing a shift comparable to the move from pattern-based antivirus to behavior-based endpoint detection and response (EDR). For decades, vulnerability management followed a barely changed routine: scanners checked systems at intervals against global databases such as the National Vulnerability Database (NVD) and produced reports many pages long.
The problem with rigid scores
That approach is reaching its limits. Standardized ratings ignore the reality of an individual IT architecture. A highly rated flaw on an isolated system with no link to critical processes poses far less risk than a seemingly minor misconfiguration on an interface with direct access to sensitive data.
Dreier makes the point bluntly: classic scanning, he says, points to a vulnerability with a score of 9.9 based on global databases, and company A receives the same list as company B. Such lists reveal nothing about individual business risk, whether a flaw is actually exploitable, or whether business processes are affected. The result is lists worked off mechanically, without lifting the company’s own security posture. Fixing a flaw does not automatically make an organization safer if resources go into holes that would never have caused damage.
Continuous Threat Exposure Management as the new yardstick
The way out is Continuous Threat Exposure Management (CTEM), a framework Gartner introduced around 2022/2023. It is not a product but an approach: define the scope, understand the infrastructure, and assess risk continuously, with priorities set by real damage potential. That takes some courage. “You have to be able to ignore a vulnerability with a high score if it is not risky for you,” Dreier says. Better, he argues, to focus on a 7.2 that would have landed on page 287 of a classic list, because in your own context it is the greater threat.
AI-assisted validation and the blast radius
Technically, this means combining automated validation with artificial intelligence. Check Point uses current AI models to generate scripts, validates them, and runs them against customers’ external attack surface to replay multi-step attack scenarios, including ones not yet widely known. Classic software bugs are only part of the picture. Leaked credentials and misconfigurations are just as often the way in. Dreier cites an internal GPT portal secured with single sign-on and multi-factor authentication: it is of little use if the blob storage behind it is publicly readable.
The second factor is the blast radius, the damage an attacker can do once inside. The crown jewels usually sit deep in the internal network, so the vendor pulls in telemetry from endpoint, perimeter and OT tools, regardless of manufacturer. Data from CrowdStrike, Palo Alto or Microsoft Defender can be included. No platform is the best in every discipline, Dreier concedes.
Bridging IT and OT in the Mittelstand
The DACH region faces its own challenges. American companies tend to move faster toward cloud and managed services, which shifts the risk toward supply chains. German-speaking firms are more cautious, with on-premises and hybrid infrastructures, complex manufacturing environments and separate teams for cloud, OT and the rest, which can cause friction.
The IT/OT interface is especially sensitive. “OT does not work without IT, and IT does not work without OT,” says Dreier. As a reference, he names the Israeli Ministry of Health, where Check Point works with around 60 hospitals and draws on medical device data through an integration with Medigate. A scanner cannot simply be applied to an MRI machine, and nor can an update. Risks must therefore be understood and contained without immediate patching, including the question of whether lateral movement from IT into OT is possible.
Platform or best-of-breed?
Whether to consolidate or stay with specialists depends on the use case and the company’s philosophy, says Dreier. Specialists are not easy to find in the DACH region. Check Point therefore leaves the choice open: customers can buy through its Infinity portal or keep their existing tools and connect them by integration.
Proactive instead of reactive
Dreier’s closing message points to the attackers. Vulnerabilities and misconfigurations are analyzed and published ever more automatically, which makes targeted attacks easier, not least those with political motives. Companies must respond by using such models themselves, simulating attack scenarios and becoming much faster. Reactive protection is not to be neglected, but the better the risk is understood, the less incident response is needed. Asked whether Check Point itself is prepared for this, Dreier answers briefly that he assumes so. For customers, the message is clear: knowing your own risk beats working through someone else’s list.
Dr. Dietmar Müller is an experienced IT journalist and editor-in-chief of Beyond Buzzwords. He has decades of expertise in the German and international IT markets, as well as extensive editorial experience at renowned publishing and media companies such as Springer, IDG, and CBS Interactive. Whether writing cross-media technical articles, conducting in-depth analyses, or conducting insightful interviews—whether at his desk or in direct dialogue with industry leaders—Dr. Dietmar Müller is right at home in the world of enterprise IT. His key areas of focus include enterprise IT and OT architectures, the cloud, ERP, MES, data centers, cybersecurity and compliance, industrial automation, and AI governance, among others.