Vulnerability Management in the Age of AI
Vulnerability Management just got even harder to do. An avalanche of AI-assisted attackers, combined with enormous waves of security updates, makes it even more challenging than it already was. As defenders, we know that there was security debt in keeping up with all the security updates, vulnerabilities, and defensive actions that we could take. Before AI, defenders were mostly able to keep up with patching. But now the security debt is due, and many of the defenders have trouble keeping up. Jeroen will present his ideas on efficiently dealing with the firehose of vulnerability information. We can finally let go of the CVSS score, focus on the technical and organizational aspects of vulnerabilities, with a way to lure the hidden IT systems out of the shadows.
AI Summary
Disclaimer: This session information was generated with the help of AI.
The information has been reviewed and refined by the Swiss Cyber Storm team before publishing.
Jeroen van der Ham-de Vos argues that vulnerability management can no longer keep pace with the exploding volume of Common Vulnerabilities and Exposures (CVE) records. He explains why a Common Vulnerability Scoring System (CVSS) score measures severity rather than risk, why the Known Exploited Vulnerabilities (KEV) catalog and the first.org Exploit Prediction Scoring System (EPSS) arrive late or remain uncertain, and why National Vulnerability Database (NVD) scoring is now inconsistent. He proposes Stakeholder-Specific Vulnerability Categorization (SSVC) decision trees, which separate shared technical facts from organizational context and yield auditable actions tuned to risk appetite.
Video chapters
0:00Introduction and the exploding CVE volume3:24Speaker background in vulnerability disclosure4:53Why CVSS measures severity, not risk9:41Threat metrics, the KEV catalog and EPSS14:24Environmental metrics and asset context15:58SSVC decision trees21:33Inconsistent CVSS scoring after the NVD backlog24:20Bridging analysts and business, and shadow IT26:59Questions and answers
Key facts
- According to the speaker, about 40,000 CVEs were published last year, more than 80,000 have already been published this year, and more than 400 arrive per day.
- The CVSS documentation states that the base score measures severity, not risk; the threat and environmental metric groups adjust the score using exploit availability and asset context.
- EPSS by first.org is a machine learning model that estimates the probability that a vulnerability will be exploited in the next 30 days.
- The NVD scored nearly every CVE until 2023, ran into capacity problems in 2024, and in 2026 limits its own scoring to selected critical vulnerabilities, leaving the rest to vendors.
- The US government uses SSVC openly to set update timelines for federal systems.
Ideas
- SSVC replaces an abstract score from zero to ten with a decision tree whose outcome is a direct action, tuned to the organization's risk appetite and leaving an audit trail for every decision.
- Decision points split into technical properties that are the same for everyone, such as exploitation status and attacker utility, and contextual properties such as exposure, mission impact and safety impact, so suppliers can supply the former while organizations decide only the latter.
- Separating technical and business reasoning lets vulnerability analysts and business or risk owners talk to each other, instead of expecting technical analysts to master business context for every vulnerability.
- Treat unknown shadow IT systems as mission critical by default: their vulnerabilities then require immediate patching, which prompts business owners to explain the system's true importance and register it.
- Running an explicit decision tree against the previous year's vulnerabilities shows the remediation capacity needed at a given risk appetite, giving boards a concrete basis for investment and strategic preventive measures.
Keywords
- CVE
- KEV
- EPSS
- National Vulnerability Database (NVD)
- Stakeholder-Specific Vulnerability Categorization (SSVC)
- CVSS
- Shadow IT
- vulnerability prioritization
Quotes
- “It doesn't measure risk but risk is what we want to know.”
- “Patching is not going to solve this problem anymore.”
Recommendations
- Stop treating the CVSS base score as a risk score; adopt an SSVC-style decision tree that takes business context into account explicitly and maps outcomes to actions matching your risk appetite.
- Use the KEV catalog and EPSS as inputs rather than early warnings: a vulnerability on the KEV list on an internet-facing system may already mean compromise, and a low EPSS score, such as the 5% for the Zammad flaw exploited at the Dutch Institute for Vulnerability Disclosure (DIVD), does not justify ignoring it.
- Inferred from the talk: when SSVC outcomes reveal recurring vulnerabilities in a system, invest in strategic controls such as firewalls or stricter access control rather than relying only on ever faster patching.
Resources
- Stakeholder-Specific Vulnerability Categorization (SSVC) — Framework — Turns vulnerability triage into auditable, risk-appetite-based actions and separates technical facts from business context.
- Known Exploited Vulnerabilities (KEV) Catalog — Website — Signals high-risk vulnerabilities, but by definition only after exploitation has begun.
- Exploit Prediction Scoring System (EPSS) — Model — A high score warrants attention, but a low score is no reason to ignore a vulnerability, and its reliance on historical data may lag the current surge in CVEs.
About the speaker
Jeroen van der Ham-de Vos
Associate Professor
at
University of Twente
Jeroen van der Ham-de Vos is an associate professor at the University of Twente in the DACS group.
He is intrigued by the concept of cybersecurity vulnerabilities, and especially the socio-technical angle of the problem-space around vulnerabilities.
This can range from topics like coordinated vulnerability disclosure policies, vulnerability management in organizations, to ethics of cybersecurity and computer science in general.
Read more …
Read more …