Jay Jacobs
where else to find them
what they talk about
all 5 in the filters
where they keep going back
- CVE/FIRST VulnCon & Annual CNA Summit3 editions2024–2026
- RSA Conference2 editions2020–2024
all 7 in the filters
on a stage with
all 10 in the filters
who talks about the same things
- Art Manion19 talks
- Ben Edwards8 talks
- Sander Vinberg7 talks
- Christopher R Robinson24 talks
- Wade Baker5 talks
- Jeff Williams13 talks
| title | conference | date |
|---|---|---|
| The Vulnerability Identity Crisis | FIRST Conference 2026 (FIRSTCON26) | 2026-06-14 |
Current vulnerability records lack consistent identity, so the talk proposes a structural working definition and a rearchitecture: a vulnerability is a… | ||
| How EPSS Is Wrong and Useful at the Same Time | FIRST Conference 2026 (FIRSTCON26) | 2026-06-14 |
EPSS outputs a daily probability (0–100%) that a CVE sees observed exploitation in the next 30 days, trained on a matrix of roughly 2,800 features and ~110… | ||
| A Paradigm Shift in Vulnerability Identity: Why Vulnerability Databases Struggle | CVE/FIRST VulnCon 2026 & Annual CNA Summit | 2026-04-13 |
Argues for an identity-first redesign that replaces prose-heavy CVE records with small, machine-verifiable assertions; two years of weekly design work shows… | ||
| CVE Decaf: Brewing Better and More Actionable Data Quality | CVE/FIRST VulnCon 2026 & Annual CNA Summit | 2026-04-13 |
Introduces a practical Data Quality Assessment Framework that separates schema limits from how CNAs populate fields, classifying issues as population gap… | ||
| BOF: Vulnerability Data Consumers | CVE/FIRST VulnCon 2025 | 2025-04-07 |
People describe concrete pain: brittle JSON/XML parsing, lots of one-off checks, and mass flattening of nested arrays; common tooling is bash + jq and Splunk… | ||
| Towards a Minimum Viable Enumeration of Vulnerabilities | CVE/FIRST VulnCon 2025 | 2025-04-07 |
Proposal claims the absolute MVVE is just two fields: a unique public identifier and a product identifier including version/build, enough to initiate discovery… | ||
| State of EPSS and What to Expect from Version 4 | CVE/FIRST VulnCon 2025 | 2025-04-07 |
EPSS v4 claims to predict the probability a CVE sees exploitation in the next 30 days and expands sources to include malware, GitHub, Shodan and commercial… | ||
| Quantifying the Probability of Flaws in Open Source | RSA Conference 2024 | 2024-05-06 |
Analysis covers 30,000 GitHub projects used in enterprise apps, compares them to OpenSSF’s 1.2M repo database and finds only 48,000 overlap. Real app scans… | ||
| Seeing the Vulnerable Forest Through the Exploited Trees | CVE/FIRST VulnCon 2024 & Annual CNA Summit | 2024-03-25 |
Dataset combines sensors from Foret Shadowserver AlienVault GreyNoise F5 Cisco and Cyentia and records 13,266 CVEs across ~2,830 days as ~8.1 million rows of… | ||
| EPSS: Challenges and Opportunities Going Forward + EPSS AMA | CVE/FIRST VulnCon 2024 & Annual CNA Summit | 2024-03-25 |
A live standard for estimating the probability a CVE is exploited in the next 30 days is now public and four years old, with scores produced for ~230,000 CVEs… | ||
| Towards Real World Cyber Risk (Panel) | FIRSTCON21 Virtual Edition 2.0 | 2021-06-07 |
A forecasting pipeline predicts total CVE volume up to a year using a serial-number estimator (WWII-style) plus a queuing (Little's law) model, achieving about… | ||
| FIRSTCON21 - June 8 | Stream 2 Part 2 (14:30-15:30 UTC) | 33rd Annual FIRST Conference 2021 | 2021-06-06 |
Three concrete systems and measurements: a volume forecaster combines Little's Law queue modeling and CVE serial-number (capture‑recapture) prediction to… | ||
| Nurture vs. Nature in AppSec: Data-Driven Measurement of DevSecOps | RSAC 2021 | 2021-05-17 |
Data from Veracode and Cyentia analyzes 132k applications, >1M scans and ~10M findings and shows about 3 in 4 apps have at least one flaw and ~1 in 4 have high… | ||
| 8 Million Findings in One Year: Fresh Look at the State of Software Security | RSA Conference 2020 DevSecOps & Application Security | 2020-02-24 |
Jay Jacobs, Co-founder and Chief Data Scientist, Cyentia Institute
Chris Wysopal, Co-Founder and Chief Technology Officer, Veracode
What can we learn from 8.3… | ||
| Visualizing Security | BSidesSF 2020 | 2020-02-23 |
Animated packet captures from AWS reveal a slow, massive scan that originates from Vietnam and runs for roughly 40 hours across TCP and UDP, created by… | ||
| nothing matches | ||