Last week I participated in a webinar with Advisen and a panel of industry experts on estimating costs from breaches more accurately. Our focus was our recent IRIS 20/20 publication and the key findings from that report. Hundreds of attendees join the all too brief discussion and we didn’t have time to address all of…
RiskRecon and the Cyentia Institute published the Internet Risk Surface and Cloud Risk Surface reports in mid-2019. These studies analyzed data from RiskRecon spanning over five million Internet-facing hosts from ~20,000 organizations as well as major hosting providers around the world. The primary goal was to explore dimensions of interconnectivity, interdependence, and risk exposure that…
As my colleague Ben recently pointed out, in our latest collaboration with Veracode on the State of Software Security Volume 10, we analyzed more than 85,000 applications to try to better understand application security. We sliced things every which way: What percentage of security flaws are fixed? How long does it take to fix the…
It has been a while since my last (and first real) post. We’ve been busy, and so, in the interest of getting back into the swing of blogging I’d like to talk about a fun bit of analysis on application security we did in a fresh off the presses report. In our latest collaboration with…
The Prioritization to Prediction report series is an ongoing research initiative between Kenna Security and the Cyentia Institute. The first volume proposed a model for predicting which of the numerous hardware and software vulnerabilities published each month were most likely to be exploited, and thus deserving of priority remediation. The second volume sought to apply…