Nothing to Risk but Risk Itself: Expanding Vulnerability Risk with Internet-Scale Data
summary
Claim: expanding measurements yields actionable vulnerability prioritization. Uses Bitsight’s Groma internet scanner plus EPSS, CVSS vectors, KEV lists and dark‑web CTI to measure prevalence, remediation and attacker sophistication across ~40M orgs and 2.7B hostnames. Finds EPSS distribution mode ~0.5% (few CVEs are imminently exploitable), a median remediation of ~1–1.5 months, and surprising concentration examples (one jQuery CVE ~1M detections/month) showing systemic supply‑chain hotspots and where targeted fixes cut global exposure.
AI-written summary · about
chapters (26)
- 0:00Vulnerability risk expansion
- 1:03Vulnerability risk with data science
- 3:09Probability and loss in risk
- 8:03Current risk assessment methods
- 8:46Why CVSS is useful
- 13:21Evaluating SSVC and frameworks
- 14:02EPSS as risk prediction
- 17:09Limitations of MITER ATT&CK
- 18:32Software criticality in risk
- 20:38Internet-scale vulnerability data
- 22:43Local vulnerability risk
- 23:06Global vulnerability prevalence
- 25:35Remediation time as risk
- 27:41EPSS and remediation urgency
- 29:03Sophisticated attackers' targets
- 30:28Regional attacker behavior
- 32:12Ransomware loss measure
- 34:19Systemic software supply risk
- 35:43Vulnerability in software packages
- 38:08Inequality in vulnerability exposure
- 40:55Gini coefficient impact
- 42:42Exploitation versus concentration
- 44:46Supply chain market share
- 46:31Practical risk takeaways
- 48:16Shared data importance
- 50:29Q&A on prioritization
related talks
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
50mWorrisome Web Vulnerability Trends in the Race to Innovation
15mKeynote
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
20mEvolving from patch management to risk mitigation
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015
33mFrom Chaos to Calm: Vulnerability Management for a Dynamic, Sprawling Technology Estate
54mTowards Real World Cyber Risk (Panel)