Understanding Exploitability with VEX, EPSS, and Other Standard Frameworks
Talkat GitOpsCon North America 2024 · on Monday, 2024-04-15· at 13:30· Level 3 | Room 320 | Track 1·
summary
Claim: CVE volumes are exploding — projecting 50,000 CVEs in NVD in 2025 (~136/day) — while NVD already nears 250,000 entries and KEV lists only a few hundred known exploited items. Real workflows include generating massive SBOMs (Google example: 100,000 SBOMs), using CycloneDX and DependencyTrack, and mapping CVSS, EPSS (30-day exploit probability) and VEX statements. Surveys show operational pain: 73% work with 10+ producers monthly and 75% use spreadsheets to track vendor risk, causing overwhelm and missed context.
AI-written summary · about
chapters (10)
- 0:00Vulnerability management challenges
- 5:38CVEs and prioritization limits
- 8:13SBOMs and dynamic inventory
- 13:31Mapping vulnerabilities to CVEs
- 17:17False positives and alert fatigue
- 20:50Vulnerability impact assessment
- 21:34VEX statements for context
- 23:43Supply chain collaboration gaps
- 27:18Trust in vulnerability disclosure
- 30:09Future of vulnerability communication
related talks
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
48m5 Steps to VEX Success: Managing the End-to-End Workflow
45mVEXing Open Source Security: Vulnerability Data for Everything
54mTowards Real World Cyber Risk (Panel)
15mKeynote
52mThe Evolution of CVEs, Vulnerability Management, and Hybrid Architectures
57mSeeing the Vulnerable Forest Through the Exploited Trees
17mThe Hidden Cost of CVEs: Can CSAF and VEX Change the Equation?