From Chaos to Calm: Vulnerability Management for a Dynamic, Sprawling Technology Estate
summary
A vulnerability program replaces blind CVE counts with prioritized attack paths, automated enrichment and ownership assignment, and offensive probing that finds OIDC account takeovers and subdomain hijacks missed by scanners. Data shows 26,000 disclosures in 2023 and an industry finding that only ~1% are exploited in the wild, so the team builds serverless pipelines to stitch Wiz, Shodan and Tenable outputs, auto-enroll assets, infer owners, and drop SLA windows like the counterproductive 72-hour rule.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 3:56Vulnerability management challenges
- 12:52Technology estate footprint
- 19:33Mitigating technical debt
- 27:41Offensive security analysis
- 32:39Q&A
related talks
59mMadness of Vulnerability Management in Modern Cloud, Container, How to Win the Battle...
27mEffective Vulnerability Management for a DevSecOps Pipeline
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
20mEvolving from patch management to risk mitigation- 43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
33mVulnerability Management Lifecycle in DevSecOps
44mVulnerability Management that developers won't hate
59mWho’s Vulnerability Is It Anyway? Harmonizing Stakeholder Roles in Vulnerability Management