Keynote
summary
Presents how industry exploitation surged 180% in 2024 while organizations remedied only about 10% of new CVEs, creating a large backlog; notes that only ~1% of CVEs are actually exploited. Recommends augmenting CVSS with external predictive signals (EPSS for 30‑day exploitation probability, SISA/LEVs, EU Vulnerability Database) plus internal factors (internet exposure, asset criticality, lateral spread) to compute an internal risk score. Shows that applying such a score can shrink thousands of “critical” items to a manageable list (example: 15,000 down to five fixes) within 30 days.
AI-written summary · about
chapters (9)
- 0:00Theme introduction
- 1:45Vulnerability management importance
- 3:31Vulnerability remediation challenges
- 6:19Communication and risk issues
- 8:08Risk-based approach
- 10:11Scoring models and threat intelligence
- 11:15Internal context and prioritization
- 13:02Internal scoring example
- 14:07Takeaways and conclusions
related talks
51mWhen it Comes to Managing Risk, Context is King
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
54mTowards Real World Cyber Risk (Panel)
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
27mExploited CVEs of 2024: Lessons for Vendors and Defenders
52mThe Evolution of CVEs, Vulnerability Management, and Hybrid Architectures
56mOutpacing Attackers: How Data-Driven Insights Speed Up Vulnerability Remediation