When it Comes to Managing Risk, Context is King
summary
Tenable Research shows CVE totals exceed ~285,000 with ~40,000 published in 2024, and argues CVSS overstates severity while EPSS predicts exploitation likelihood; only ~13% of 2024 CVEs have PoC and <1% show active exploitation. EPSS thresholds narrow focus — EPSS 0.9 = 2,554 CVEs and EPSS ≥0.3 is ~3% of CVEs — yet many exploited CVEs hide at low EPSS. Prioritize CISA known exploited ~1,300 and apply aggressive SLAs (seven days) for those, automate asset context and environmental metrics (CVSS temporal/environmental) for defensible, measurable remediation.
AI-written summary · about
chapters (29)
- 0:00Introduction
- 1:26Targeted attacks inevitability
- 2:12Tactical vs strategic risk
- 3:14Vulnerabilities overwhelming growth
- 4:19Compliance-based limits
- 5:45Why CVSS fails
- 8:57CVSS temporal & environmental
- 13:29Potential vs actual risk gap
- 16:18Opportunistic attackers focus
- 17:41EPSS predictive scoring
- 20:51EPSS limitations & dangers
- 22:59Context beyond scores
- 24:00Defensible vulnerability strategy
- 27:10Known exploited tracking
- 28:55External vs internal risks
- 29:57SLAs for risk categories
- 31:01Panic during threats
- 32:45CUPS vulnerability case
- 35:35Ivanti zero-day case
- 36:39Apache Parquet case
- 38:02Prioritization key factors
- 40:10Summary & data strategy
- 41:18Q&A
- 42:41Q&A compensating controls
- 43:46Q&A no risk context
- 44:49Q&A contextual examples
- 46:12Q&A automated scoring
- 47:18Q&A confirmed vs potential
- 49:04Q&A risk vs downtime
related talks
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
15mKeynote
01h 23mEPSS: Challenges and Opportunities Going Forward + EPSS AMA
54mTowards Real World Cyber Risk (Panel)
40mHow EPSS Is Wrong and Useful at the Same Time
30mCVE Context Matters, but Do All Vulnerabilities Really Matter?
40mCVSS Scores Are Dead. Let’s Explore 4 Alternatives
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026