Is Aqua's risk-based vulnerability prioritization actually saving you time?

I've been running Aqua Security's CSPM (Cloud Security Posture Management) and vulnerability scanning suite for our containerized environments across AWS and GCP for approximately 18 months now. A primary justification for the procurement, beyond the obvious compliance requirements, was the promised efficiency gain from their "risk-based" vulnerability prioritization engine. The sales pitch was compelling: move from thousands of generic CVSS-based alerts to a handful of truly exploitable, context-aware risks.

My initial hypothesis, which I've been tracking, is that this feature should significantly reduce mean time to remediation (MTTR) for critical issues and decrease the overall cognitive load on my security engineering team. However, after a significant observation period, I'm conducting a deep-dive analysis and am skeptical about the actual time savings versus a well-tuned, traditional CVSS-based system with manual triage.

Here is a breakdown of my observations and the specific metrics I'm tracking:

**The Promise vs. Our Configuration:**
Aqua's risk engine supposedly factors in:
* Runtime context (e.g., is the vulnerable package actually loaded in a running container?)
* Network exposure (is the vulnerable workload publicly accessible?)
* Workload sensitivity (does it handle PII, financial data?)
* Exploit availability (is there a known exploit in the wild?)
* Compensating controls.

We have integrated it with our CI/CD pipeline (Jenkins), registry (Artifactory), and runtime environments (EKS, GKE).

**Quantitative Data from Last Quarter:**
* **Total Vulnerabilities Detected (All Images):** 12,847
* **Marked as "High" or "Critical" by Aqua's Risk Engine:** 312
* **Manually Triaged from the "High/Critical" Set:** 312 (100% triage rate necessary)
* **False Positives or Deemed Not Immediately Actionable from "High/Critical" Set:** 89 (~28.5%)
* **Critical Vulnerabilities Found *Outside* of Aqua's High-Priority List** that required emergency patching (based on internal threat intel): 3

**The Time Analysis Problem:**
The claim is that it saves time by reducing the alert volume. Yet, we find ourselves spending considerable time on:
1. **Validation:** We must still verify the context Aqua provides (e.g., "is this workload *truly* internet-facing according to our IaC, not just runtime discovery?").
2. **Engine Opaqueness:** The exact weighting of factors in their risk score is a black box. This necessitates a "trust but verify" approach, which carries its own overhead.
3. **Configuration Tuning:** Continual adjustment of policies and risk rules to align with our organization's specific threat model, which negates some "out-of-the-box" savings.

**Code Block Example: Policy Tuning Overhead**
For instance, to ensure a vulnerability is only critical if the workload is publicly accessible AND has no WAF in front, we had to craft a custom policy. This isn't trivial.

```yaml
apiVersion: v1
group: runtime-policies
kind: RuntimePolicy
metadata:
name: custom-critical-public-exposure
spec:
conditions:
- field: vulnerability.exploitExists
operator: equals
value: "true"
- field: workload.externalExposure
operator: equals
value: "true"
- field: workload.hasWAF
operator: equals
value: "false"
actions:
- action: setSeverity
value: CRITICAL
- action: sendNotification
channel: slack-security-alerts
```

My question to the community is empirical: are you observing measurable time savings in your security operations lifecycle? I'm particularly interested in:

* Have you been able to reduce the size of your dedicated vulnerability management team or reallocate their time due to Aqua's prioritization?
* What key performance indicators (KPIs) are you using to measure the efficiency gain? (e.g., "vulnerabilities reviewed per engineer per hour," "MTTR reduction for critical issues").
* How does the time spent on tuning and maintaining the Aqua system compare to the time previously spent on manual triage of a larger, raw CVSS-based feed?
* Has anyone performed a formal A/B test or a before/after cohort analysis comparing Aqua's prioritized list to a simple CVSS >= 7.0 list from an open-source tool?

Without concrete data, we're left with vendor anecdotes. I aim to collect statistically rigorous feedback from actual practitioners to determine if this is a genuine technological advancement or simply a different, albeit more sophisticated, form of alert filtering.