Vulnerability Intelligence Report: A Risk-Centric Approach To Prioritization

Share and earn Cybytes
Facebook Twitter LinkedIn Email

<p>Tenable Research set out to provide organizations with the real-world data they need to take a risk-centric approach to vulnerability management.</p>
<p>Insight into the true state of cyber exposure – how defenders are actually acting – not how they think or say they are, has so far been difficult to discern.</p>
<p>The newly released <a href=””>Vulne… Intelligence Report</a> provides an overview of current vulnerability disclosure trends and insights into real-world vulnerability demographics in enterprise environments. The report analyzes vulnerability prevalence in the wild, based on the number of affected enterprises, to highlight vulnerabilities that security practitioners are dealing with in practice, not just in theory.</p>
<p>With 61% of all vulnerabilities detected in enterprise environments rated as a High severity, cybersecurity teams are challenged to determine which vulnerabilities truly represent a risk. They need to prioritize the most critical vulnerabilities to maximize limited remediation resources. When everything is urgent, triage fails.</p>
<h2>Better prioritization is critical</h2>
<p>In order to prioritize, organizations first need to better understand the actual, not theoretical, impact of vulnerabilities. As a prioritization metric, CVSS has its shortcomings. It lacks granularity at scale and volume, as the majority of vulnerabilities are classified as High or Critical severity. The shift from CVSSv2 to CVSSv3 only adds to the problem, as the majority of vulnerabilities are now registered as either ‘High’ or ‘Critical.'</p>
<p>Common sense dictates that if everything seems important, then nothing is – and a better way of prioritization is needed. Such insight needs to incorporate context, such as threat intelligence, so organizations can prioritize vulnerabilities based on actual threats ‘in the wild.'</p>
<p>Tenable Research set out to provide such insight in the <a href=””>Vulne… Intelligence Report </a>.</p>
<p>The report analyzes vulnerability prevalence, based on the number of maximum affected enterprises on a single day, to highlight the vulnerabilities security practitioners are dealing with on a daily basis.</p>
<p>On average, an enterprise is finding 870 CVEs across 960 assets every single day. This means prioritization methodologies based on remediating only High severity CVEs still leave the average enterprise with more than 548 vulnerabilities per day to assess and prioritize, often on multiple systems.</p>
<p>This means prioritization methodologies based on remediating only critical CVEs will still leave the average enterprise with over a hundred vulnerabilities per day to prioritize per patch, often on multiple systems. Adding to the problem is the fact that vulnerabilities not defined as ‘critical’ (i.e., having a CVSS score lower than 9), can have a catastrophic effect – for example WannaCry exploited a vulnerability with a score below 9.0 (the vuln was listed as 8.5).</p>
<p>This study confirms managing vulnerabilities is a challenge of scale, velocity and volume. It is not just an engineering challenge, but requires a risk-centric view in order to prioritize thousands of vulnerabilities that superficially all seem the same.</p>
<p>The report introduces the Top 20 Vulnerability Chart – providing insight into the most prevalent vulnerabilities that exist across different technologies in the enterprises. The chart utilizes real-world telemetry data to reveal which vulnerabilities are actually present in enterprise environments and subsequently represent the greatest true risk. Organizations can use this information to put into perspective their own list of vulnerabilities as compared to the larger population.</p>
<h2>Key findings</h2>
<li><i>The haystack is getting bigger</i> – 15,038 new vulnerabilities were published in 2017 in total, versus 9,837 in 2016, an increase of 53%. 2018 is on track for 18,000-19,000 new vulnerabilities. Almost two thirds (61%) of the vulnerabilities enterprises are finding in their environments have a CVSSv2 severity of High (7.0-10.0).</li>
<li><i>But there are few needles</i> – Public exploits are available for just 7% of all vulnerabilities. The reality is that, for most vulnerabilities, a working exploit is never developed and of those an even smaller subset are actively weaponized and employed by threat actors. Finding and fixing the 7% is critical to improving an organization’s cyber exposure.</li>
<p>At current projections, more than 1,500 exploited vulnerabilities will be published in 2018, or just over 28 exploited vulnerabilities every week. Better insight is a necessity, not a ‘nice to have.’ Download the Vulnerability Intelligence Report <a href=””>here </a> to gain the insight you need to begin building a risk-based approach to prioritization.</p>
<p><b>Learn More:</b></p>
<li>Download the <a href=””>Vulne… Intelligence Report</a>.</li>
<li>Read the eBook: <a href=”… to Prioritize Cybersecurity Risk: A Primer for CISOs</a>.</li>
<li>Read our tech blog: <a href=”… Vulnerability Intelligence Insights Worth Your Attention</a></li>

Share this post and earn Cybytes
Facebook Twitter LinkedIn Email
About Tenable
Tenable™, Inc. is the Cyber Exposure company. Over 24,000 organizations of all sizes around the globe rely on Tenable to manage and measure their modern attack surface to accurately understand and reduce cyber risk. As the creator of Nessus®, Tenable built its platform from the ground up to deeply understand assets, networks and vulnerabilities, extending this knowledge and expertise into™ to deliver the world’s first platform to provide live visibility into any asset on any computing platform. Tenable customers include over 50 percent of the Fortune 500, large government agencies and organizations across the private and public sectors. Learn more at
Promoted Content
Five Steps to Building a Successful Vulnerability Management Program
Is your vulnerability management program struggling? Despite proven technology solutions and the best efforts of IT teams, unresolved vulnerabilities remain an ongoing source of friction and frustration in many organizations. Regardless of how many vulnerabilities are fixed, there will always be vulnerabilities that can’t easily be remediated – and too often, finger-pointing between IT teams and business groups can ensue.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Cybrary On The Go

Get the Cybrary app for Android for online and offline viewing of our lessons.

Get it on Google Play

Support Cybrary

Donate Here to Get This Month's Donor Badge

Skip to toolbar

We recommend always using caution when following any link

Are you sure you want to continue?