The CVE Stampede Is a Distraction, Finding the Vulns that Matter is the Challenge
With 48,000+ CVEs published annually, the challenge isn't volume. It's finding the vulnerabilities attackers will actually exploit.
CVE
From Threat Intel to ‘VulnOps’: Why Level 1 SOC as We Know It Is Heading to Extinction
Traditional security operations: CTI feeds piped into a SIEM, alerts routing into a ticket queue, and analysts triaging the resulting flood is running out of road. A new operational model is emerging in its place, and it doesn’t look much like what most security teams currently have in place.
How to Build a Vulnerability Intelligence Pipeline That Doesn't Rely on NIST's NVD
With NIST's National Vulnerability Database now triaging only a fraction of incoming CVEs, security teams must diversify beyond NVD while rethinking patch SLAs and risk scoring.
NIST Declares “Inbox Zero,” Pulls Back on CVE Enrichment. Now Enterprise Security Teams Must Fill the Gap
An analysis of the National Vulnerability Database's shift to risk-based triage and what it actually means for the people patching systems (first of a two-part analysis)
Reflections on the CVSS Keynote
Go talk to some VM teams, and you, too, will see what I see.
