Seeing the Vulnerable Forest Through the Exploited Trees
summary
Dataset combines sensors from Foret Shadowserver AlienVault GreyNoise F5 Cisco and Cyentia and records 13,266 CVEs across ~2,830 days as ~8.1 million rows of network-based exploitation attempts (signatures capture attempts not guaranteed successes). Overall roughly 4–6% of published CVEs see exploitation; about less than 10% in the first year while many exploits target decade-old bugs (peaks around 10–14 years). Vendor efficiency varies (Advantech/Adobe/Microsoft high by proportion), offensive tooling like Metasploit ~75% coverage signals higher exploitation likelihood, and EPSS iterations improve coverage vs efficiency.
AI-written summary · about
chapters (10)
- 0:00Introduction and background
- 2:17Data sources and scope
- 4:50Analyzing exploitation
- 7:14Vendor and indicator analysis
- 13:06Predictive modeling metrics
- 14:52Coverage versus efficiency
- 26:23Persistence of exploitation
- 33:48Peak exploitation timing
- 41:05Attacker behavior patterns
- 45:44Conclusions and Q&A
related talks
27mExploited CVEs of 2024: Lessons for Vendors and Defenders
54mTowards Real World Cyber Risk (Panel)
16mHistorical Analysis of Exploit Availability Timelines
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
51mWhen it Comes to Managing Risk, Context is King
40mHow EPSS Is Wrong and Useful at the Same Time
15mKeynote