{"id":49109,"date":"2026-09-21T11:06:21","date_gmt":"2026-09-21T05:36:21","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/?p=49109"},"modified":"2026-09-21T12:18:17","modified_gmt":"2026-09-21T06:48:17","slug":"cve-coverage-vanity-metric","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/penetration-testing\/cve-coverage-vanity-metric\/","title":{"rendered":"Can Autonomous Pentesting Rescue CVE Coverage From Vanity Metric Hell?"},"content":{"rendered":"\n

The security industry killed CVE coverage as a credible metric, and it deserved to die. Vendors inflated the numbers for years in the name of depth, and nobody in the room had an incentive to ask whether they reflected real validated risk or just a longer signature list. <\/p>\n\n\n\n

So “CVE coverage is a vanity metric” became earned consensus. The question I keep coming back to is whether the autonomous pentesting era makes that consensus outdated.<\/p>\n\n\n\n

The playbook was simple: inflate the CVE count and market it as more depth without having any validation mechanism. The attack surface even did the vendors a massive favor as usage of third-party supply chain libraries exploded. More libraries meant more published CVEs, which meant the count inflated itself organically on top of the padding vendors were already doing. I find it staggering that an industry built on trust ran this playbook in broad daylight and nobody flinched.<\/p>\n\n\n\n

As applications grew more complex and dependency trees deeper, this CVE inflation compounded into false positives and made CVE coverage lose every shred of credibility it once carried as a yardstick.<\/p>\n\n\n\n

The root problem was always context. Until very recently, acquiring context and applying reasoning during a pentest was something only a human tester could do. Scanners never had that capability, so every scanner was engineered to flag the smallest signal, over-report by design, and essentially mark everything as a finding while the customer sorted through the wreckage. Missing a live CVE is a terrible outcome for vendors because it validates the argument that manual pentesting is superior. <\/p>\n\n\n\n

So the industry chose alert fatigue over accountability, and then had the audacity to call it a best practice. I have sat in rooms where vendors defended this logic with a straight face, and I have watched CISOs accept it because no alternative existed.<\/p>\n\n\n\n

We solved this at Astra years ago with vetted scanning, where every finding goes through a human validation layer before it reaches the customer. It works, but it costs real money and real time, and most other vendors are simply unwilling to absorb that cost because it eats into their margins. <\/p>\n\n\n\n

So they left the noise in, forcing customers into the same ugly choice: swallow false positives or narrow coverage and risk missing something real. Customers pick the first option every single time because the second one leaves them less safe.\u00a0<\/p>\n\n\n\n

Autonomous pentesting has the capability to force the industry back into integrity, and I think it will.<\/p>\n\n\n\n

CVE-2025-55315 is a request smuggling flaw in ASP.NET Core’s Kestrel server, rated 9.9. That score is Microsoft’s worst case across every application ever built on Kestrel, and what it actually costs you depends entirely on how your app was written and what sits in front of it. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

A scanner reads the runtime version, matches the CVE, and stamps a 9.9 critical on every host it touches. An autonomous engine checks reachability and exploitability first, works toward a functioning PoC, and hands the result to validator agents before anything touches your report.<\/p>\n\n\n\n

That validation step is where the economics of the entire category shift. False positives die before they reach the dashboard, which means security teams stop burning hours triaging noise and start working on exposures that are actually real. The cost of clearing false positives drops, the signal-to-noise ratio climbs, and CVE coverage becomes a number worth trusting again. The customers who always wanted a large CVE pool as a safety blanket finally get what they wanted, because a validated count can be both big and honest. <\/p>\n\n\n\n

I am seeing real movement here. Every serious player entering this market now ships a validator agent that sits between raw findings and the final report. The implementations vary, and the variety matters:<\/p>\n\n\n\n