Much has been said about SOAR, and this modern security approach does indeed help close many gaps by outlining a systematic approach.
But SOAR’s emphasis on the response phase means you will only be putting out fires, not preventing them. And because SOAR is risk-based, it doesn’t always address every vulnerability.
In a world where hackers don’t care about statistics–and where the payoffs for exploiting old vulnerabilities are huge and growing–asset classification and risk prioritization don’t go far enough in determining what gets patched.
In fact, focusing too much on risk may actually be lowering rates of vulnerability remediation. According to one WhiteHat Security study, remediation rates are down from 57% in 2017 to 46% in 2019. The fatalistic approach that total remediation is impossible may be stopping some companies from even trying.