Kenna Katalyst Risk-Based Vulnerability Management Educational Series

Vulnerability management is difficult. A risk-based approach makes it easier.

GET STARTED

learn more

Join us for an on-demand educational series designed to shift your vulnerability management focus to risk, featuring six steps to set up your own program.

sponsored by

COMPLETE THE FORM TO ACCESS THE EDUCATIONAL SERIES

The Challenge of VM by the Numbers

Research Results

The number of vulnerabilities keeps increasing, but the capacity available to fix those vulnerabilities is finite.

Vuln volume is increasing

part 1: Research Results

VIDEO

The Challenge of VM

COMPLETE THE FORM TO ACCESS THE EDUCATIONAL SERIES

2000

2003

2006

2009

2012

2015

2018

18k

Annually Published CVES

12k

There are A LOT of Vulnerabilities

Monthly number of published CVEs from 1999 through 2019

6.1k published per year

18k published per year

1.3k published per year

120,000

Published Vulnerabilities

COMPLETE THE FORM TO ACCESS THE EDUCATIONAL SERIES

Build out your toolkit

Know Your Vulnerabilities

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk-Based

5% Pose a Risk

The Challenge of VM

The Challenge of VM by the Numbers

Research Results

The number of vulnerabilities keeps increasing, but the capacity available to fix those vulnerabilities is finite.

Vuln volume is increasing

VIDEO

2000

2003

2006

2009

2012

2015

2018

18k

Annually Published CVES

12k

There are A LOT of Vulnerabilities

Monthly number of published CVEs from 1999 through 2019

6.1k published per year

18k published per year

1.3k published per year

120,000

Published Vulnerabilities

part 1: Research Results

The Challenge of VM

5% Pose a Risk

part 1: Research Results

5% Pose a Risk

Know Your Vulnerabilities

The Challenge of VM

Build out your toolkit

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk-Based

Part 2: The Six Steps of Risk-Based Vulnerability Management

The Challenge of VM by the Numbers

Research Results

The number of vulnerabilities keeps increasing, but the capacity available to fix those vulnerabilities is finite.

Vuln volume is increasing

part 1: Research Results

VIDEO

COMPLETE THE FORM TO ACCESS THE EDUCATIONAL SERIES

The Challenge of VM

2000

2003

2006

2009

2012

2015

2018

18k

Annually Published CVES

12k

There are A LOT of Vulnerabilities

Monthly number of published CVEs from 1999 through 2019

6.1k published per year

18k published per year

1.3k published per year

120,000

Published Vulnerabilities

Build out your toolkit

Know Your Vulnerabilities

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk-Based

5% Pose a Risk

The Challenge of VM

The Challenge of VM by the Numbers

Research Results

The number of vulnerabilities keeps increasing, but the capacity available to fix those vulnerabilities is finite.

Vuln volume is increasing

VIDEO

2000

2003

2006

2009

2012

2015

2018

18k

Annually Published CVES

12k

There are A LOT of Vulnerabilities

Monthly number of published CVEs from 1999 through 2019

6.1k published per year

18k published per year

1.3k published per year

120,000

Published Vulnerabilities

part 1: Research Results

The Challenge of VM

5% Pose a Risk

Build out your toolkit

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk-Based

Part 2: The Six Steps of Risk-Based Vulnerability Management

part 1: Research Results

5% Pose a Risk

Know Your Vulnerabilities

The Challenge of VM

The Challenge of VM by the Numbers

Research Results

The number of vulnerabilities keeps increasing, but the capacity available to fix those vulnerabilities is finite.

Vuln volume is increasing

part 1: Research Results

VIDEO

The Challenge of VM

2000

2003

2006

2009

2012

2015

2018

18k

Annually Published CVES

12k

There are A LOT of Vulnerabilities

Monthly number of published CVEs from 1999 through 2019

6.1k published per year

18k published per year

1.3k published per year

120,000

Published Vulnerabilities

Build out your toolkit

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

5% Pose a Risk

Part 2: The Six Steps of Risk-Based Vulnerability Management

The Challenge of VM

Build out your toolkit

Know Your Vulnerabilities

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk-Based

5% Pose a Risk

The Challenge of VM

Get Ahead With Risk-Based

part 1: Research Results

5% Pose a Risk

Know Your Vulnerabilities

The Challenge of VM

Focus on the 5% that Pose a Risk

Research Results

Our research also revealed that only 5% of vulnerabilities are observed and exploited. And that with the right approach, organizations can address the majority of risk in their environment.

VIDEO

Not ALL Vulns Need Remediating Right Now

Ratio of observed/not observed and exploited/ not exploited vulnerabilities

Not Exploited / Not Observed

Not Exploited / Observed

= 250 CVEs

Exploited / Not Observed

Exploited / Observed

15%

29%

51%

Focus on the 5%

5% Pose a Risk

part 1: Research Results

Prioritize these!

10k

100k

10m

100m

10k

100k

10m

100

Avg. monthly closed vulnerabilites

Firms Cannot Fix ALL Vulnerabilities

Average number of observed vs. closed vulnerabilites per month

Avg. monthLy observed vulnerabilites

Vulnerabilities Fixed

You can fix 1 in 10

VIDEO

part 1: Research Results

Get the right team & skill sets

Build out your toolkit

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Part 2: The Six Steps of Risk-Based Vulnerability Management

The Challenge of VM

Build out your toolkit

Know Your Vulnerabilities

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk-Based

5% Pose a Risk

The Challenge of VM

5% Pose a Risk

Get Ahead With Risk-Based

part 1: Research Results

5% Pose a Risk

Know Your Vulnerabilities

The Challenge of VM

Get Ahead Using a Risk-Based Approach

Research Results

Firms engaging in a risk-based approach to VM have shown the ability to stay on top of their high-risk vulnerabilities. There are several data-driven measures we’ve seen them use to improve their VM performance.

VIDEO

You Can Get Ahead

Key Performance Measures

20% Increase

10%

20% Decrease

15%

Proportion of Firms

12%

Firms CAN Stay on Top of High-Risk Vulns

Comparison of net remdiation capacity for high-risk vulnerabilites among firms

16% of orgs are maintaining

51% of orgs are reducing their high risk vulnerabilities

Average Monthly Change in High-Risk Vulnerabilites

33% of orgs are falling behind

Capacity

Measures the number of vulnerabilities that can be remediated in a given timeframe and net gain or loss.

Efficiency

Measures the precision of remediation. What percentage of remediated vulnerabilities are actually high risk?

Measures the completeness of remediation. What percentage of exploited or “high-risk” vulnerabilities are remediated?

Coverage

Velocity

Measures the speed and progress of remediation.

Composite performance measure based on the above.

Overall

Get Ahead With Risk-Based

part 1: Research Results

Keeping up

Key Performance Measures

part 1: Research Results

The Challenge of VM

5% Pose a Risk

Build out your toolkit

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Part 2: The Six Steps of Risk-Based Vulnerability Management

VIDEO

Build out your toolkit

Know Your Vulnerabilities

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk-Based

5% Pose a Risk

The Challenge of VM

Get Ahead With Risk-Based

part 1: Research Results

5% Pose a Risk

Know Your Vulnerabilities

The Challenge of VM

Know Your Vulnerabilities

VIDEO

Get the right team & skill sets

Part 2: The Six Steps of Risk-Based Vulnerability Management

Get The Right Team and Skill Sets

Vulnerability management is a team sport. To be a winning team, you’ll need a roster of qualified people with the right capabilities.

Survey Data: Remediation Team Size

100

12%

22%

21%

15%

A Team Sport

Remediation Team Size

“How many participants are involved in the remediation process?”

VIDEO

part 1: Research Results

5% Pose a Risk

Get the right team & skill sets

Build out your toolkit

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Part 2: The Six Steps of Risk-Based Vulnerability Management

Build out your toolkit

Know Your Vulnerabilities

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk-Based

5% Pose a Risk

The Challenge of VM

Get the right team & skill sets

Part 2: The Six Steps of Risk-Based Vulnerability Management

Get Ahead With Risk-Based

part 1: Research Results

5% Pose a Risk

Know Your Vulnerabilities

The Challenge of VM

VIDEO

Build out your toolkit

part 1: Research Results

Build Out Your Toolkit

To do any job the right way, you need proper tools. Vulnerability management is no different. You’ll need the correct toolkit to know your assets and find your vulnerabilities.

Know Your Assets

Find Your Vulnerabilities

Know Your Assets

Asset Management

Perfection is the Enemy of the Good

Internal & External

Discovery Scans

Infrastructure

Vulnerability Scanners

Endpoint Protection

Agents and Cloud

Applications

SAST

DAST

IAST

SCA

Pen Testing

Bug Bounty

Where Are My Vulnerabilities?

Part 2: The Six Steps of Risk-Based Vulnerability Management

VIDEO

Part 2: The Six Steps

Know Your Vulnerabilities

Build out your toolkit

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Part 2: The Six Steps of Risk-Based Vulnerability Management

Build out your toolkit

Know Your Vulnerabilities

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk-Based

5% Pose a Risk

The Challenge of VM

Build out your toolkit

Part 2: The Six Steps of Risk-Based Vulnerability Management

Get Ahead With Risk-Based

part 1: Research Results

5% Pose a Risk

Know Your Vulnerabilities

The Challenge of VM

Know Your Vulnerabilities & the Threat Landscape

Since very few vulnerabilities are exploited in the wild it is important to understand what attackers are doing because that determines the likelihood of a vulnerability being exploited.

VIDEO

Useful Intel Sources

4 Key Factors

Useful Intelligence Sources

Open Source Intel Feeds

Intrusion Detection Systems

File-Ordered Malware Analysis APIs

Cloud-Based Honeypots

Local Honeypots

Endpoint Protection Systems

Zero-Day Threat Intel

Social Media (with caveats)

Know Your Vulnerabilities

part 1: Research Results

4 Key Factors for Prioritization

Is there a weaponized exploit?

Is the Vulnerability Useful To An Attacker (RCE)?

How prevalent is the vulnerability?

Part 2: The Six Steps of Risk-Based Vulnerability Management

Are There Active Successful Exploitations "In the Wild"?

[CEROS OBJECT]VIDEO

Part 2: The Six Steps

Know Your Vulnerabilities

Build out your toolkit

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Part 2: The Six Steps of Risk-Based Vulnerability Management

Build out your toolkit

Know Your Vulnerabilities

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk-Based

5% Pose a Risk

The Challenge of VM

Get Ahead With Risk Based

Part 2: The Six Steps of Risk-Based Vulnerability Management

Get Ahead With Risk-Based

part 1: Research Results

5% Pose a Risk

Know Your Vulnerabilities

The Challenge of VM

Understand Your Assets & Risk Tolerance

To know your assets and applications is to truly know your risk. That can be a daunting task, so it helps to break it down.

[CEROS OBJECT]VIDEO

When it comes to risk tolerance, ask yourself where you want your remediation to be:

At your industry benchmark

Faster than your peers

Faster than attackers

Know your Assets

Risk Tolerance

Here’s what the metadata you’ve collected can tell you about your assets:

Asset Ownership

Asset Function / Business Process

Confidentiality? Integrity? Availability?

Impact and Value

Understand Your Assets

part 1: Research Results

It's All About That Metadata

Impact and Value

Asset Function / Business Process

Asset Ownership

Confidentiality? Integrity? Availability?

Part 2: The Six Steps of Risk-Based Vulnerability Management

VIDEO

Part 2: The Six Steps

Know Your Vulnerabilities

Build out your toolkit

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk Based

Part 2: The Six Steps of Risk-Based Vulnerability Management

Build out your toolkit

Know Your Vulnerabilities

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk-Based

5% Pose a Risk

The Challenge of VM

Understand Your Assets

Part 2: The Six Steps of Risk-Based Vulnerability Management

Know Your Assets

part 1: Research Results

5% Pose a Risk

Know Your Vulnerabilities

The Challenge of VM

Bring It All Together, Measure, and Evaluate

Measure and evaluate your data, and come up with a prioritized list of vulnerabilities for remediation — based on risk.

VIDEO

The Science

Comparing VM Approaches

Data Science Framework

We recommend that the data science techniques employed should include machine learning, natural language processing, and predictive modeling to assess, prioritize, and even predict risk.

Data Science

Natural Language Processing

Predictive Modeling

Vulnerability Inference

Logistic Regression

Random Forest

SVM

Comparing VM Approaches

Measure & Evaluate

part 1: Research Results

Part 2: The Six Steps of Risk-Based Vulnerability Management

VIDEO

Part 2: The Six Steps

Know Your Vulnerabilities

Build out your toolkit

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk-Based

Part 2: The Six Steps of Risk-Based Vulnerability Management

Build out your toolkit

Know Your Vulnerabilities

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk-Based

5% Pose a Risk

The Challenge of VM

Measure & Evaluate

Part 2: The Six Steps of Risk-Based Vulnerability Management

Measure and evaluate your data, and come up with a prioritized list of vulnerabilities for remediation — based on risk.

part 1: Research Results

5% Pose a Risk

Know Your Vulnerabilities

The Challenge of VM

Remediate, Communicate, and Report

Remediation strategies will vary based on the overall risk tolerance of your enterprise, as well as risk tolerance within individual departments.

VIDEO

Decision Matrix

Remediation Strategies

The Effect of Patch Management Tools on Remediation Coverage

Deploying patches using patch management tools results in an almost 20% higher successful close rate on high-risk vulnerabilities.

Remediation Decision Matrix

High Risk — High Effort

High Risk — Medium Effort

High Risk — Low Effort

Medium Risk — High Effort

Medium Risk — Medium Effort

Medium Risk — Low Effort

Low Risk — High Effort

Low Risk — Medium Effort

Low Risk — Low Effort

Remediate & Communicate

part 1: Research Results

Part 2: The Six Steps of Risk-Based Vulnerability Management

FINISH SERIES

Assets covered by a management tool

Coverage (higher is better)

25%

50%

75%

100%

more than 50%

less than 50%

65%

44%

VIDEO

Part 2: The Six Steps

Know Your Vulnerabilities

Build out your toolkit

part 1: Research Results

5% Pose a Risk

Know Your Vulnerabilities

The Challenge of VM

Build out your toolkit

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk Based

Part 2: The Six Steps of Risk-Based Vulnerability Management

Build out your toolkit

Know Your Vulnerabilities

Understand Your Assets

Measure & Evaluate

Remediate & Communicate

Get the right team & skill sets

Get Ahead With Risk-Based

5% Pose a Risk

The Challenge of VM

Remediate & Communicate

Part 2: The Six Steps of Risk-Based Vulnerability Management

Congratulations, you have completed the Risk-Based Management Video Series

Request a demo

Download Report Series

We hope that you were able to enjoy a few “aha” moments and take away a number of practical tips. Now that you know more about what it takes to bring your vulnerability management practice to the next level please feel free to contact us to see how we can help get you there.