FIRSTCON21 - June 8 | Stream 2 Part 2 (14:30-15:30 UTC)
summary
Three concrete systems and measurements: a volume forecaster combines Little's Law queue modeling and CVE serial-number (capture‑recapture) prediction to forecast annual CVE counts (predicted 15,663 vs actual 16,160, ≈5% error); an EPSS exploit probability model uses 16 objective features, produces calibrated EPSS scores (probability exploited within 12 months), beats CVSS on precision/recall and will expose a centralized API; and empirical analysis shows exploitation is heavy‑tailed (≈5% of CVEs account for ~95% of attacks) and attackers reuse exploits for ~800 days.
AI-written summary · about
chapters (11)
- 0:00Welcome
- 3:13Sponsor video
- 4:44Panel introduction
- 5:47Vulnerability forecasting
- 16:56Model validation
- 25:24Exploit Prediction Scoring System
- 37:17CVSS versus EPSS
- 41:28Vulnerability exploitation details
- 51:43Attacker economics
- 57:24Risk assessment insights
- 58:47Closing and Q&A
related talks
54mTowards Real World Cyber Risk (Panel)
01h 23mEPSS: Challenges and Opportunities Going Forward + EPSS AMA
57mSeeing the Vulnerable Forest Through the Exploited Trees
40mHow EPSS Is Wrong and Useful at the Same Time
15mKeynote
51mWhen it Comes to Managing Risk, Context is King
58mState of EPSS and What to Expect from Version 4
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks