In today’s digital age, threat intelligence has become a buzzword in the cybersecurity realm. It’s often seen as a vital tool to fortify defenses and stay one step ahead of malicious actors. However, a recent study conducted by the Cyentia Institute, in collaboration with Cisco Secure, raises intriguing questions about the relationship between threat intelligence…
In the ever-evolving landscape of cybersecurity, threats don’t discriminate based on the size of the organization or the industry it operates in. Protecting assets and sensitive information is a universal concern, and it’s a challenge that unites businesses of all kinds. As the saying goes, “There’s no competition when it comes to safeguarding against intrusions.”…
Our mission here at the Cyentia Institute has always been to raise the bar of knowledge and practice in the field of cybersecurity through data-driven research. Looking back over the years, I’m proud of the work we’ve done in pursuit of that mission. And if I had to pick one particular stream of research that…
In our previous blog post, we discussed the importance of prioritizing vulnerability remediation based on exploit intelligence. But once vulnerabilities are prioritized, the question arises: How fast should they be fixed? In this follow-up post, we delve deeper into the concept of timing remediation efforts and explore the dynamics of exploitation activity. Our ongoing exploration…
“Infosec twitter” has been used to describe the vibrant, active and often enthusiastic community of security practitioners working in and around the industry. It’s been a source of insight, inspiration and entertainment for many and for years. Therefore, it is with a bit of sadness that I must announce that the death of infosec twitter…
Fair warning: This post summarizes years of in-depth research on vulnerability remediation rates. There’s no way to do justice to all the ins and outs of that research…but I’m gonna do my darnedest to hit the highlights. There are hundreds of published pages to dig into if you think I’ve brushed over too many details…
For two decades, I’ve heard security professionals urging organizations to “just patch your stuff” as though they don’t already know that and/or it’s as simple as saying those words. This is where real data and “thought leaders” differ. The data acknowledges that things aren’t so simple in the real world because vulnerability remediation is a…
It has been quite a while since we have done an update on published exploit code tracked in Cyentia’s Exploit Intelligence Service. The primary purpose of the feed is to identify and monitor exploit code being published, though as we will see in part 2 of this post, there are other interesting data points in…
Confession time… every time I hear someone cite a statistic around “mean (or median) time to remediate (MTTR)” within cyber security, I have a wave of skepticism wash over me and I find myself questioning the MTTR statistic, adding to my skepticism is a general lack of transparency about how it’s calculated. Now, I’ve been…
For me, cybersecurity can seem small. Beyond my community of friends and colleagues, all I can see is a cyber world that is a mirrored reflection of a reflection of repeated activities. Attack. Defend. Analyze. Adapt. Attack. Defend. Analyze. Adapt. While the attackers are generally conceived as US foreign adversaries(1), the rest of the cycle…