Security Advisories and Vulnerability Prioritization in the Wild
summary
Study of 24 semi‑structured interviews maps how organizations actually handle the flood of ~19,000 CVEs/year and ~1,000 NCSC advisories per year (about 40 high/critical advisories annually). Findings: the mailbox as central inflow plus vendors and scanners drive what gets seen; smaller orgs rely on external risk scores and dual-role staff, larger ones automate checks and use ticketing to track remediation; NCSC advisories are effective to persuade management to patch.
AI-written summary · about
chapters (8)
- 0:00Start
- 2:12Security Advisories
- 7:48Research Results
- 8:02How Do Organizations Uh Process and Prioritize Vulnerability Information
- 9:39Key Observations of of the Study
- 10:42Reactive Learning versus Proactive Searching
- 19:33Reporting
- 20:36Smaller Organizations Have Less Formalized Reporting Processes
related talks
39mSecurity Advisory Programs: Creating Transparency Along the Software Supply Chain
31mA Glimpse Into OSS Vulnerability Disclosure Practices
30mCVE Context Matters, but Do All Vulnerabilities Really Matter?
15mKeynote
52mThe Evolution of CVEs, Vulnerability Management, and Hybrid Architectures
39mOrganizational Context Matters: Security Control Effectiveness on Vulnerabilities for Prioritization
51mPanel Discussion: It is a Tale as Old as Time…. a CNA, the NVD, and a CVE Consumer Walk Into a ...
09mInterview