The Hidden Cost of CVEs: Can CSAF and VEX Change the Equation?
summary
Estimate that a single Windows CVE can consume 200 million global human hours when scaled across organizations, and a recent Patch Tuesday hits ~120 Windows CVEs at once, forcing triage shortcuts. Chrome publishes at least 186 CVEs in the first three months and red teams submit vulnerabilities in bulk, so automation is mandatory. Microsoft’s Azure Linux VEX feed sees 100 million VEX reads in March, yet the CNA ecosystem is lopsided and the top 20 CNAs are not fully enriching records, so CSAF/VEX tooling and shared pipelines must be built.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:08Hidden cost of CVEs
- 4:42CSAF and VEX potential
- 8:54Automation challenges
- 11:01CNAs and tools challenges
- 13:32Building industry tools
- 15:58Preserving CVE unity
related talks
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
50mBOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
52mThe Evolution of CVEs, Vulnerability Management, and Hybrid Architectures
41mKeeping Up With The Joneses (CVEs)
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
54mTowards Real World Cyber Risk (Panel)
30mThe Growing Crisis in CVE Data Quality