Why Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
summary
Vulnerability volume rises ~20% year‑over‑year and NVD entries doubled in 3–4 years, leaving 16.3% of flaws open >1 year and many “vintage” CVEs still exploited; CVSS groups 57% of NVD as high/critical but only ~3–5% are ever exploited. EPSS uses EPSS (XGBoost) trained on 6.4 million observed exploitation attempts to give a 30‑day exploit probability and shows rising scores before CISA listing. Zoom’s VISS (0–100) yields examples like 95.53 VISS score. SSVC uses SSVC decision trees (track/attend/act), is automatable, and combines these signals with asset and business context.
AI-written summary · about
chapters (8)
- 0:00Vulnerability prioritization challenges
- 3:22Vulnerability growth impact
- 7:00CVSS limitations
- 15:16EPSS exploitation prediction
- 30:21VSS impact assessment
- 37:16Contextual prioritization factors
- 41:17SSVC methodology
- 56:28Q&A
related talks
51mWhen it Comes to Managing Risk, Context is King
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
15mKeynote
40mCVSS Scores Are Dead. Let’s Explore 4 Alternatives
40mHow EPSS Is Wrong and Useful at the Same Time
54mTowards Real World Cyber Risk (Panel)
58mNothing to Risk but Risk Itself: Expanding Vulnerability Risk with Internet-Scale Data
37mPrioritizing Vulnerability Response with a Stakeholder Specific Vulnerability Categorization