In case you missed it, Kenna Security recently released the latest report in our ongoing joint effort to measure and improve vulnerability management (VM). Prioritization to Prediction, Volume 5: In Search of Assets at Risk examines the vulnerability landscape through the lens of common asset platforms. I’ll briefly share two charts from the report along…
As my colleague Ben recently pointed out, in our latest collaboration with Veracode on the State of Software Security Volume 10, we analyzed more than 85,000 applications to try to better understand application security. We sliced things every which way: What percentage of security flaws are fixed? How long does it take to fix the…
It has been a while since my last (and first real) post. We’ve been busy, and so, in the interest of getting back into the swing of blogging I’d like to talk about a fun bit of analysis on application security we did in a fresh off the presses report. In our latest collaboration with…
This week Cyentia partnered with RiskRecon to cover the Risk Surface Report. This is the first report in a series covering organizational and third (and fourth and…) party risk. The report lays out risk landscape across a number of different dimensions. You should go read it right now! But here I want to talk about…
Last Thursday, Veracode released their 9th State of Software Security (SOSS) report, and we here at Cyentia were fortunate to be able to help out with the research this year. The primary data that Veracode has to work with is findings from source code analysis. But what really makes this data valuable is that the…
I’ll be honest, I have a love/hate relationship with confidence intervals. On one hand, they are indispensable — confidence intervals put a (quantified) frame around outcomes and helps us understand the “strength” of our observations. On the other hand, they can be just plain confusing and may create more confusion for many readers. Explaining why…
We recently had Christos Mitas on the Cyentia Podcast. Christos works in the insurance industry creating models of natural catastrophes (among other areas). Just a little over six minutes in, I asked him how the risk from catastrophe models were communicated. This is a critical question because risk communication could be thought of as a…
This blog series is sponsored by Secure Systems Innovation Corporation (SSIC), a cyber risk advisory services firm that empowers business decision making. To learn more about SSIC and its support for this research, please visit their website and/or related blog post on this topic. Posts in this series: Part 1: Ransomware payment Rate; Part 2: Ransom Demands;…
This blog series is sponsored by Secure Systems Innovation Corporation (SSIC), a cyber risk advisory services firm that empowers business decision making. To learn more about SSIC and its support for this research, please visit their website and/or related blog post on this topic. Posts in this series: Part 1: Ransomware payment Rate; Part 2: Ransom Demands;…
This blog series is sponsored by Secure Systems Innovation Corporation (SSIC), a cyber risk advisory services firm that empowers business decision making. To learn more about SSIC and its support for this research, please visit their website and/or related blog post on this topic. Posts in this series: Part 1: Ransomware payment Rate; Part 2: Ransom Demands;…