CVSS Scores Are Dead. Let’s Explore 4 Alternatives
summary
CVSS is a snapshot, not a risk score, so teams drown in alerts: public counts rise from 6,000→18,000/year and Microsoft advisories from 400→1,500 (2016–2020), while many orgs still triage by CVSS with 30/60/180‑day SLAs that let low‑scoring privilege‑escalation bugs slip into exploit kits. Alternatives examined are EPSS, SSVC, VPR; they add exploit likelihood, deployment prevalence, attacker type and cost/benefit logic and Recorded Future-style blending gives real‑time alerts and integration days before NVD so fixes are actionable.
AI-written summary · about
chapters (8)
- 0:00Start
- 1:11Let's Talk About Vulnerabilities
- 3:37Too Many Vulnerabilities
- 4:50History of CVSS
- 6:31The Problem...
- 8:02In Summation
- 19:03The Recorded Future Approach
- 25:47Apply What You Have Learned Today
related talks
01h 16mCVSS SIG Past, Present & Future + CVSS v4.0 Beyond the Numbers
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
51mWhen it Comes to Managing Risk, Context is King
15mKeynote
24mUpdates from the CVSS SIG
50mCVSS v4.0 By The Numbers
32mOperationalizing SSVC
32mExploit Maturity: Your New Best Friend in CVSS