Interview
summary
The talk explains that disclosed vulnerabilities are increasing (around 40,000 last year) while teams patch only about 10% per month, leaving a persistent backlog. It recommends building an internal risk score that combines public data feeds (CVSS, EPSS, Lev, CIS, ACEV) with asset and business context, and then prioritizing and coordinating IT and development teams to fix vulnerabilities that actually reduce business risk rather than chasing severity alone.
AI-written summary · about
related talks
33mWhy have we not fixed all the vulnerabilities yet? Different perspectives...
24mSecurity Advisories and Vulnerability Prioritization in the Wild
10mHandling Security Issues
58mPanel Discussion - The Risks of Requiring Premature Vulnerability Disclosures
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
22mGive up! Just stop patching vulnerabilities!
29mMake It Fixable: Preparing for Security Vulnerability Reports
32mIs Vulnerability Management Dead? A Security Architect’s...