Twitter Mentions More Effective Than CVSS at Reducing Exploitability

Monitoring Twitter mentions of vulnerabilities may possibly be two times as productive as CVSS scores at encouraging corporations prioritize which bugs to patch first, according to new analysis.

Kenna Security’s latest report, Prioritization to Prediction, Volume 8: Measuring and Reducing Exploitability, was compiled with enable from the Cyentia Institute.

It verified what lots of security industry experts have been indicating for some time: the sheer volume of CVEs learned these days signifies businesses must get superior at prioritizing which vulnerabilities to resolve.

✔ Approved Seller From Our Partners

Protect yourself against all threads using Malwarebytes. Get Malwarebytes Premium with 60% discount from a Malwarebytes official seller SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Despite the fact that an regular of 55 bugs have been learned every day in 2021, the fantastic information is that only 4% posed a high risk to corporations, according to the exploration. It went further more, claiming that 62% of the vulnerabilities analyzed had a less than a 1% chance of exploitation, although only 5% exceeded a 10% probability.

To arrive at its findings, Kenna Security used an field-devised Exploit Prediction Scoring Process (EPSS), which uses CVE data and serious-earth exploit details to forecast “whether and when” vulnerabilities will be exploited in the wild.

Not all vulnerability administration approaches are made equal, argued Kenna Security co-founder and CTO, Ed Bellis.

“Prioritizing vulnerabilities with exploit code is 11 situations additional efficient than CVSS scores in minimizing exploitability. Mentions on Twitter, surprisingly, also have a much much better signal-to-sound ratio than CVSS (about two times superior),” he wrote.

“We also acquired that, offered the option, it’s much extra helpful to improve vulnerability prioritization than boost remediation ability … but performing both can attain a 29-instances reduction in exploitability.”

Bellis concluded that prioritizing bugs through exploitability rather than technological CVSS scores is “the system of the future” and one that US authorities security experts surface to be taking.

“The information exhibits that having this much more calculated method of prioritizing exploitability above CVSS scores is the way to go and the recent Cybersecurity and Infrastructure Security Company (CISA) directive agrees,” he argued.