Concern about disrupting systems (49%), excessive manual effort (46%), and poor integration with existing security processes (42%) are the top barriers to validating whether threats are exploitable.