Changing from Probability to Prioritization Method in Risk Measurement
summary
Proposes replacing probability with a product-focused prioritization framework that combines vulnerability scans, pentests, code scanners, threat intel and patch data into one database, classifies issues by five tiers (product, exposure, access control, public exploit, CVSS), and applies positive/negative modifiers plus PLA (protection level agreement) tied to risk appetite. Uses Excel + Power BI as a stopgap, takes about three years to scale, cuts an example backlog from 8,000 to 35 urgent fixes, enforces compliance with financial penalties, and keeps the process live via ThreatIntel.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 3:10Risk measurement challenges
- 6:00Introducing Protection Level Agreements
- 8:38Five-level risk classification
- 11:05Prioritizing risks with modifiers
- 14:18Real-world impact
- 17:46Benefits for teams and business
- 21:46Implementation results
- 24:58Recommendations
- 29:22Overcoming resistance
- 31:32Q&A
- 32:16Evolving PLA process
- 33:42Applying the approach to regulatory compliance
- 35:14Beyond probability in risk
- 36:20Tools and tips
- 37:25Non-critical vulnerabilities
- 40:22Risk acceptance policies
related talks
27mFlipping the Criticality Funnel, A Practical Path to Real Prioritization
45mThe Business Value of Security
39mOrganizational Context Matters: Security Control Effectiveness on Vulnerabilities for Prioritization
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
18mNormalizing AppSec Issues for Contextual Risk-Based Prioritization at Enterprise Scale
27mSolving CISO Headaches: How to Align CTI and Risk Management
57mMaking Security Priority Zero
27mGet Your Security Priorities Straight! How to Identify Workloads Und...