CVE Context Matters, but Do All Vulnerabilities Really Matter?
summary
Scanners produce wildly different results for the same image — four scanners can report completely different sets of CVEs — so focus on feeds, per-product vendor scores versus NVD, and whether the scanner flags CISA’s known-exploited catalog. Fewer than 1% of CVEs are ever exploited so prioritize internet-facing and production workloads, automate fixes through CI/CD and rebuild and redeploy not hotpatching, prefer OS package managers and minimal base images, and watch for CVSS v4 adoption and <1% exploited metrics.
AI-written summary · about
chapters (16)
- 0:00Vulnerability management intro
- 1:47How scanners work
- 4:36Choosing the right scanner
- 6:23Zero vulnerabilities ≠ zero risk
- 9:10Prioritizing by real risk
- 10:38Understanding CVSS scores
- 13:48Vendor CVSS scores matter
- 15:57Known exploited vulnerabilities first
- 16:59Context in vulnerability assessment
- 19:26Fixing everything is unrealistic
- 21:36Remediation for cloud-native workloads
- 23:49Proactive risk mitigation
- 24:10Engineering to reduce exposure
- 26:37DevOps role in security
- 28:43Beyond scanners
- 29:04Balancing remediation and innovation
related talks
51mWhen it Comes to Managing Risk, Context is King
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
39mOrganizational Context Matters: Security Control Effectiveness on Vulnerabilities for Prioritization
24mOvercoming CVE Shock - Adding Perspective in Vulnerability Scanning
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
24mSecurity Advisories and Vulnerability Prioritization in the Wild
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
38mCVE — Myth and Reality