The Art of Vulnerability Management - Practical Application of Cyber Triage
summary
A real-world exercise maps ~3,170 assets to 62,000 vulnerabilities, finds about 5% (≈3,100) matter to the business, and notes 58 days to triage versus ~12 days to exploitation. Prioritization uses agent-based scans, EPSS/MVD threat signals, SAST/DAST, STRIDE/OWASP threat modeling and CIS hardening; hardening eliminates ~70–80% of issues. A commercial orchestration platform kikimora.io combines AI triage and consulting hours to condense thousands of findings into roughly 50–100 actionable, high-risk fixes.
AI-written summary · about
chapters (11)
- 0:00Vulnerability management intro
- 1:09Vulnerability management as intelligence
- 3:59Critical 5% of vulnerabilities
- 7:19Threat modeling for prioritization
- 10:08Unknown vs known vulnerabilities
- 14:41Vulnerability scanning techniques
- 19:42Static vs dynamic testing
- 22:32Prioritizing with threat intel
- 25:43Triage scoring factors
- 31:05Fortifying defenses basics
- 35:23Q&A
related talks
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
32mIs Vulnerability Management Dead? A Security Architect’s...
33mFrom Chaos to Calm: Vulnerability Management for a Dynamic, Sprawling Technology Estate
33mOverwhelmed by Vulnerability Triage Hear a Blend of Finest Best Practices
27mEffective Vulnerability Management for a DevSecOps Pipeline
20mEvolving from patch management to risk mitigation
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
39mThe AI Arms Race in Vulnerability Management, Who’s Winning?