41% of companies use percentage of exposures remediated as a cybersecurity metric.

47% deprioritise exposure remediation due the effectiveness of compensating controls to prevent or detect an exploit.