Security teams are being urged to re-evaluate their vulnerability management strategies to better prepare for an anticipated surge in patching requirements. The current default practice of prioritizing vulnerabilities based solely on the Common Vulnerability Scoring System (CVSS) is insufficient, as CVSS measures theoretical severity rather than actual risk.
CVSS provides a score indicating how severe a vulnerability could be if exploited, but it does not account for the likelihood of exploitation. This means organizations may be dedicating resources to patching vulnerabilities with high theoretical impact but low real-world threat, while neglecting those actively being exploited.
A more effective approach involves integrating the Exploit Prediction Scoring System (EPSS) alongside CVSS. EPSS offers a probability score, ranging from 0 to 1, indicating the likelihood that a specific Common Vulnerability and Exposures (CVE) identifier will be exploited within the next 30 days. By combining a high CVSS score with a high EPSS score, organizations can identify critical vulnerabilities that demand immediate attention. Conversely, vulnerabilities with high CVSS scores but very low EPSS scores can potentially be deferred. This shift in triage logic can significantly reduce patch backlogs without compromising security posture.
Furthermore, understanding which vulnerabilities are actively being exploited is crucial. While CISA's Known Exploited Vulnerabilities (KEV) catalog is a valuable resource, its centralized nature and focus on U.S. federal visibility may not provide a comprehensive global perspective.
A decentralized approach, such as the emerging Global CVE (GCVE) initiative, offers a broader view. GCVE aims to accelerate the enrichment of vulnerability data, including exploit indicators and affected products, by allowing multiple sources of evidence to surface for a single CVE identifier. This decentralized model can deliver actionable context more rapidly than traditional pipelines, which have faced significant backlogs.
By pairing EPSS with CVSS and leveraging broader exploitation signals from initiatives like GCVE, security teams can develop a more informed and efficient vulnerability triage process. This probability-informed methodology, rather than one solely based on severity, allows for a more precise allocation of finite patching resources.
In related news, Cisco Talos has released EvidenceForge, an open-source tool designed to generate realistic, correlated synthetic security logs. This tool addresses the scarcity of high-quality, labeled datasets needed for training threat hunters and validating detection logic. EvidenceForge uses a unified event model and AI-assisted scenario authoring to ensure consistency across various log formats, injecting realistic background noise and causal sequencing to mimic real-world network environments without the complexities of using production data. Security teams can utilize EvidenceForge to build custom attack scenarios for training, testing SIEMs, and validating detection pipelines.
Separately, Cisco is adapting its own vulnerability disclosure practices to enhance the visibility of detailed technical information for vulnerabilities deemed critical, actively exploited, or having a higher likelihood of exploitation, particularly in the context of artificial intelligence.
