Threat and Exposure Research

From Alert Fatigue to Strategic Impact: A Conversation with Lisa Xu, CEO of NopSec

Sep 02, 2025
Michelangelo Sidagni

Vulnerability management is a crucial practice for maintaining your organization’s security. But many organizations are overwhelmed by the operational burden of vulnerability management. Tools abound—but too often, they produce more alerts than answers.

To explore what a more innovative, outcome-driven approach looks like, we spoke with Lisa Xu, CEO of NopSec, a pioneer in Managed Vulnerability Management (MVM). Lisa shares her perspective on where the industry is headed, what true maturity looks like, and how organizations can free their teams to focus on what really matters.

Breaking Free from Alert Fatigue

Q: Once organizations offload the burden of configuring scans and triaging findings, what should internal teams focus on instead

According to Lisa, this is the transformative power of a well-executed managed approach.

“When you unburden internal teams from configuring scans, normalizing data, and sifting through thousands of findings, you give them space to operate strategically,” she said. “They can finally stop firefighting and start building resilience.”

Lisa outlined several high-value activities that security teams can finally embrace:

Proactive Threat Hunting & Attack Path Analysis: “Instead of patching known issues, your team can actively model how an attacker might move laterally through your environment—what we call attack path clarity.”
Secure Architecture and Development: “Designing secure systems from the ground up and embedding security into DevOps practices changes the game long-term.”
Strategic Risk Communication: “Teams can spend more time translating vulnerabilities into business terms to help boards and executives make informed decisions.”
Continuous Control Validation: “You can move beyond assumptions and test whether your defenses actually work through simulated attacks and purple teaming.”
Operationalizing Threat Intelligence: “It’s not just about consuming feeds; it’s about using them to predict likely attacks and adapt your defenses.”
Fostering Security Culture: “Creating a culture of security awareness across the organization is essential and often under-resourced.”

This shift enables security teams to become “architects and strategists of cyber resilience,” Lisa said, instead of staying stuck in reactive mode.

Automation: Powerful Partner, Not Replacement

Q: How do you see the role of automation evolving in MVM?

“Automation is indispensable,” Lisa said, “but it’s not a silver bullet. It’s an amplifier.”

She described the expanding role of automation, from task execution to AI-driven diagnosis and intelligent remediation orchestration

“Automation will continue to dominate in data ingestion, normalization, initial risk scoring, ticketing, and even basic remediation,” she explained. “It’s also crucial for breach and attack simulation at scale, there’s no substitute for validating defenses in real time.”

But there’s still no substitute for human expertise. Lisa emphasized the irreplaceable value of:

Contextual Understanding: “Only humans can truly understand how a vulnerability affects a specific business process or operational dependency.”
Strategic Judgment: “Especially with novel threats, humans balance risk, impact, and agility in ways machines can’t.”
Creative Problem-Solving: “From zero-day exploits to configuration issues, complex problems demand human ingenuity.”
Ethical Oversight: “Humans ensure automation aligns with ethical guidelines and organizational priorities.”
Cross-Team Collaboration: “People drive remediation forward by influencing development, operations, and business units.”

“In short,” Lisa said, “automation lifts the tactical burden so humans can rise to strategic problem-solving.”

Looking Ahead: The Future of Mature Vulnerability Management

Q: What will ‘mature’ vulnerability management look like in the next few years?

Lisa envisions a near future defined by Continuous Threat Exposure Management (CTEM), driven by a a shift from static scans to dynamic, risk-aligned processes.

“Mature organizations will operate with real-time visibility across hybrid and cloud environments,” she explained. “They’ll understand the most likely attack paths, not just individual vulnerabilities.”

She outlined five key characteristics of this evolution:

Integrated Attack Surface Management: Real-time asset discovery across cloud, on-prem, and containerized environments.
Attack Path Visualization: Mapping how an adversary could chain vulnerabilities together to reach high-value targets.
AI-Powered Prioritization: Automatically assigning risk scores that consider business impact and threat intelligence.
Continuous Security Validation: Using automated simulations to verify whether defenses work, every day, not just after scans.
Seamless Collaboration Between SecOps and ITOps: Automating ticketing, escalation, and remediation workflows to shrink Mean Time to Remediate (MTTR).

Lisa also emphasized that outcome-focused organizations will change how they measure success:

From volume metrics (like the number of vulnerabilities)
To impact metrics such as:
- Reduction in exploitable attack paths
- Validated security posture improvements
- Reduced MTTR for critical issues
- ROI on security investments based on measurable risk reduction

“We’re moving from a technical tally to a strategic business metric,” she said.

Lessons from the Front Lines of MVM

Q: What have you learned from customers who successfully transitioned to a managed approach?

Lisa shared clear patterns that differentiate successful transitions from those that struggle.

Organizations that succeed:

Start with clearly defined goals: “Whether it’s cutting MTTR by 50% or freeing up two FTEs for threat hunting, clarity drives alignment.”
Have a strong internal champion: “Change needs leadership. The best outcomes come when someone owns the transition.”
Commit to process evolution: “Outsourcing isn’t about swapping tools—it’s about adopting a smarter way of working.”
View MVM as a partnership: “Trust and communication turn vendors into extensions of the team.”
Shift success metrics to outcomes: “From counting scans to measuring risk reduction and time savings.”

Organizations that struggle:

Lack internal buy-in and preparedness.
Hold unrealistic expectations of the service.
Have poor asset data and scanner configurations.
Expect results without changing internal workflows.
Fail to reassign freed-up resources to strategic work.

“A managed service works best when it’s a strategic decision, not just a budget workaround,” Lisa said.

Cloud, AI, and Containers Are Reshaping the Game

Q: With AI, containers, and cloud-native development, are traditional scanning models still enough?

“Not even close,” Lisa replied. “Cloud-native environments are dynamic and ephemeral. Containers spin up and disappear in minutes. Traditional, periodic scans can’t keep up.”

She outlined the future of MVM in this context:

From Periodic to Continuous Validation: “Real-world simulations and breach-and-attack testing must be ongoing.”
Context-Aware Insights: “Flat reports don’t help. We need insights that map interdependencies across cloud and microservices.”
AI as a Force Multiplier: “AI must augment human analysis: identifying subtle patterns, anomalies, and predictive risks.”
Human-Machine Collaboration: “Machines manage scale and speed; humans bring judgment and strategy.”
Deep Integration with DevOps: “Security needs to shift left and embed feedback directly into CI/CD pipelines.”

Lisa made it clear: “The future of MVM is real-time, intelligent, and tightly integrated into how we build and run software.”

Let Experts Manage the Tools So Your Team Can Manage the Risk

As we concluded our conversation, Lisa returned to a powerful theme: outcomes over operations.

“NopSec exists to help organizations focus on what matters,” she said. “Let your team spend their time remediating risk, setting policy, and designing better systems, not managing scans or formatting reports.”

With a managed service like NopSec’s, customers benefit from: