Towards Real World Cyber Risk (Panel)
summary
A forecasting pipeline predicts total CVE volume up to a year using a serial-number estimator (WWII-style) plus a queuing (Little's law) model, achieving about 15,663 versus 16,160 actual CVEs (~±5% interval). A separate system, EPSS, uses 16 objective features and threat telemetry to output a calibrated exploit probability (EPSS score calibrated so 1% ≈ 1% exploited) to prioritize patches; observed remediation rates average ~10% of assets per month. Empirical analysis shows exploitation is heavy tailed — roughly 5% of vulnerabilities account for ~95% of attacks — and attacker portfolios shift on the order of ~800 days, matching exploit-market supply rates.
AI-written summary · about
chapters (12)
- 0:00Start
- 2:16Introducing Vulnerability Centre Risk Quantification
- 3:35Vulnerability Forecasting - Data trends
- 6:15Vulnerability Forecasting - Features NVO
- 12:34Vulnerability Forecasting - Prediction Framework
- 18:59Vulnerability Forecasting - CVSS or Type
- 20:53Exploit Prediction Scoring System
- 40:59The Heavy Tails of Exploitation
- 44:29Innovation in attack portfolios
- 46:59Economics of mass attacks
- 49:27A staggering match with attack innovation rates
- 51:02Factoring it all in together
related talks
51mWhen it Comes to Managing Risk, Context is King
15mKeynote
57mSeeing the Vulnerable Forest Through the Exploited Trees
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
01h 00mFIRSTCON21 - June 8 | Stream 2 Part 2 (14:30-15:30 UTC)
52mThe Evolution of CVEs, Vulnerability Management, and Hybrid Architectures
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
01h 23mEPSS: Challenges and Opportunities Going Forward + EPSS AMA