Adversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker
summary
Experience at NSO/Peagas-like operations shows that plentiful low and medium CVEs are weaponized by chaining them, with a six‑month NVD snapshot showing huge counts and SLAs that leave those flaws unpatched longer. Practical claims: exploit chains need at least one exploitable CVE, backups make exploits resilient, and teams can reproduce same‑day post‑update attacks. Tooling and techniques used include OSV graph and tspql (team pipe), SIFT/SBOM analysis, and fine‑tuned Llama 3 to label and map vulnerabilities to MITRE tactics for automated chaining.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 1:05NSO Group and Pegasus spyware
- 2:54Software vulnerabilities by severity
- 4:21Attackers exploit medium/low vulns
- 5:48Vulnerability chains in exploitation
- 7:56Security tools and prioritization challenges
- 8:59MITRE ATT&CK framework
- 10:50Prioritizing vulnerabilities via chains
- 11:52Pegasus and vulnerability chains
- 13:43Adopt attacker’s security view
- 15:50Key takeaways
- 16:32Applications and platforms overview
- 17:55Storytelling in vulnerability management
- 18:38Know enemy and infrastructure
- 19:20Vulnerability chain info for mitigation
- 21:29Map vulns to MITRE ATT&CK
- 23:43Vulnerability classes for chains
- 25:09AI in classifying vulnerability chains
- 26:38Threat modeling and chains
- 27:42Real-world vulnerability chain
- 28:04Q&A
related talks
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
42mKeynote: The Expanding Universe of Cyber Threats
51mVulnerabilities Without CVEs: Governing the Dark Matter of Internal and Unknown Software
57mSeeing the Vulnerable Forest Through the Exploited Trees
11mVulnerability Supply Chains
29mThe vulnerability apocalypse: AI broke the security playbook