Product Security Vulnerability Management Metrics are Hard
summary
Ericsson builds a state‑of‑the‑art web Technology Dashboard that pulls vulnerability data into executive reviews to drive action, not vanity. It aggregates ~15,000 vulnerabilities with ~2,000 alerts a year, shows timeliness as green/orange/red status, and reports resolution time and share of security champions per product. Challenges include upstream patch availability, research-driven metric spikes, and linking data across systems. The dashboard is already used to prioritize fixes and steer product‑security decisions, but data quality and context remain limiting factors.
AI-written summary · about
chapters (11)
- 0:00Product security metrics intro
- 2:37Telecom security challenges
- 5:10Security dashboard building
- 8:21Security champion adoption
- 10:29Vulnerability metrics definition
- 13:02Tracking vulnerability fixes
- 16:13Counting vulnerabilities challenges
- 19:47Resolution timeline complexities
- 22:17Evaluating resolution effectiveness
- 24:49Metrics for security improvements
- 26:12Conclusion & Q&A
related talks
25mSecurity Metrics: Protecting Our Digital Assets of the Future
50mSoftware Security Metrics
40mCybersecurity Metrics Development for Board and Risk Committee Reporting
35mMetrics That Matter: How to Choose Cloud Security KPIs for Your Business
27mEffective Vulnerability Management for a DevSecOps Pipeline
27mStep 0 for a Multi-party Vulnerability Coordination is Yet Another Multi-party Vulnerability Coor...
32mIs Vulnerability Management Dead? A Security Architect’s...
09mKeynote: Vulnerability Data is Not Enough: The Case for an Actionable UI