In the ever-evolving landscape of cybersecurity, threats don’t discriminate based on the size of the organization or the industry it operates in. Protecting assets and sensitive information is a universal concern, and it’s a challenge that unites businesses of all kinds. As the saying goes, “There’s no competition when it comes to safeguarding against intrusions.”…
Cisco, a global leader in technology solutions, and the Cyentia Institute, renowned for its data-driven cybersecurity research, proudly announce the release of Prioritization to Prediction Volume 9: Role of the known exploited vulnerability catalog in risk-based vulnerability management. This latest installment in the P2P research series delves into the intricacies of the “Cybersecurity and Infrastructure…
Our mission here at the Cyentia Institute has always been to raise the bar of knowledge and practice in the field of cybersecurity through data-driven research. Looking back over the years, I’m proud of the work we’ve done in pursuit of that mission. And if I had to pick one particular stream of research that…
In our previous blog post, we discussed the importance of prioritizing vulnerability remediation based on exploit intelligence. But once vulnerabilities are prioritized, the question arises: How fast should they be fixed? In this follow-up post, we delve deeper into the concept of timing remediation efforts and explore the dynamics of exploitation activity. Our ongoing exploration…
“Infosec twitter” has been used to describe the vibrant, active and often enthusiastic community of security practitioners working in and around the industry. It’s been a source of insight, inspiration and entertainment for many and for years. Therefore, it is with a bit of sadness that I must announce that the death of infosec twitter…
Fair warning: This post summarizes years of in-depth research on vulnerability remediation rates. There’s no way to do justice to all the ins and outs of that research…but I’m gonna do my darnedest to hit the highlights. There are hundreds of published pages to dig into if you think I’ve brushed over too many details…
For two decades, I’ve heard security professionals urging organizations to “just patch your stuff” as though they don’t already know that and/or it’s as simple as saying those words. This is where real data and “thought leaders” differ. The data acknowledges that things aren’t so simple in the real world because vulnerability remediation is a…
It has been quite a while since we have done an update on published exploit code tracked in Cyentia’s Exploit Intelligence Service. The primary purpose of the feed is to identify and monitor exploit code being published, though as we will see in part 2 of this post, there are other interesting data points in…
Confession time… every time I hear someone cite a statistic around “mean (or median) time to remediate (MTTR)” within cyber security, I have a wave of skepticism wash over me and I find myself questioning the MTTR statistic, adding to my skepticism is a general lack of transparency about how it’s calculated. Now, I’ve been…
In today’s interconnected digital landscape, organizations are only as strong as their weakest link when it comes to cyber defenses. The alarming headlines of breaches originating from third and fourth parties serve as a constant reminder of this truth. Finance firms, in particular, understand the risks associated with these “close encounters.” Read on to learn…