Modeling Asset Risk Using Grouped EPSS
summary
Calculates the probability that at least one CVE on an asset is exploited in 30 days by taking the product of (1 − EPSS) per CVE and inverting it, implemented with a simple pandas CSV join and group-by in Python. Uses EPSS scores to rank assets, overlays asset attributes like data classification, and measures remediation impact via delta grouped EPSS (asset score minus score after removing a CVE) so teams can see which fixes move the needle; industry backlog closes ~10% monthly.
AI-written summary · about
chapters (11)
- 0:00Modeling asset risk with EPSS
- 2:33Vulnerability management challenge
- 6:08Scaling EPSS to asset risk
- 8:55Grouped EPSS with Python
- 11:45Asset-level risk over CVEs
- 13:11Interpreting EPSS distributions
- 15:38Data to security decisions
- 17:25Identifying which CVEs move the risk needle most
- 19:55Tracking risk over time
- 23:31Key takeaways
- 25:45Q&A
related talks
40mHow EPSS Is Wrong and Useful at the Same Time
01h 23mEPSS: Challenges and Opportunities Going Forward + EPSS AMA
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
54mTowards Real World Cyber Risk (Panel)
15mKeynote
50mQuantifying Swiss Cheese, the Bayesian Way
41mIntegrating EPSS and CVSS in Open Policy Agent To Quarantine Real-world Vulnerabilities
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks