The Art of Vulnerability Management - Practical Application of Cyber Triage
summary
Claims a 3,000‑asset estate yields 62,000 vulnerabilities and that only about 5% truly matter; triage uses agent‑based scans, threat intel EPS S scoring (epss), and asset criticality to cut that to a handful. Shows tooling and process: agent scanners for critical servers, network scans for exposure, threat feeds to find weaponized CVEs, and a product called kikimora iio to orchestrate scans and remediation. Cites hard numbers: remediation takes 58 days vs 12 days to exploitation and hardening can eliminate most findings.
AI-written summary · about
chapters (11)
- 0:00Vulnerability management intro
- 1:09Vulnerability management as intelligence
- 3:59Critical 5% of vulnerabilities
- 7:19Threat modeling for prioritization
- 10:08Unknown vs known vulnerabilities
- 14:41Vulnerability scanning techniques
- 19:42Static vs dynamic testing
- 22:32Prioritizing with threat intel
- 25:43Triage scoring factors
- 31:05Fortifying defenses basics
- 35:23Q&A
related talks
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
33mFrom Chaos to Calm: Vulnerability Management for a Dynamic, Sprawling Technology Estate
32mIs Vulnerability Management Dead? A Security Architect’s...
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
59mMadness of Vulnerability Management in Modern Cloud, Container, How to Win the Battle...
58mNothing to Risk but Risk Itself: Expanding Vulnerability Risk with Internet-Scale Data
27mEffective Vulnerability Management for a DevSecOps Pipeline
20mEvolving from patch management to risk mitigation