Vulnerabilities Without CVEs: Governing the Dark Matter of Internal and Unknown Software
summary
Argues that at least ~20% of production software lives outside CVE coverage and goes unnoticed, and shows a practical fix: use endpoint telemetry to surface exploitable behaviors (command injection in a legacy PDF converter, SSRF to 169.254 metadata, unauthenticated data exporters) and emit synthetic CVEs into the existing VM queue. Demonstrates concrete primitives—ETW on Windows, eBPF/LSM on Linux, ESF on macOS—correlating process lineage, network egress and file access so findings are defensible and actionable (isolate, restrict, decommission).
AI-written summary · about
chapters (10)
- 0:00Unmanaged software risks
- 2:51Vulnerability management blind spot
- 7:44Software risks in three worlds
- 10:34Host telemetry reveals hidden risks
- 14:45Actionable vulnerability patterns
- 19:44Synthetic CVEs integration
- 21:10Host telemetry OS primitives
- 37:05Risks detectable via telemetry
- 45:50Remediation for synthetic CVEs
- 48:21Key takeaways
related talks
21mState of Attack Surface Elimination in a World Plagued by Vulnerable Software
30mHidden Vulnerabilities in Open Source
11mVulnerability Supply Chains
37mStranger Danger: Finding Security Vulnerabilities Before They Find You!
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
28mAdversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker
39mSoftware Security Engineering (Learnings from the past to fix ...)
30mOpen Source Malware or a Vulnerability? The Philosophical Debate and How To Mitigate