Analysis And Forecasting Of Exploits With AI

The talk targets a common gap: security managers who struggle to grasp the threat landscape well enough to plan protection. The approach starts by mapping organizational assets and risks with an open standard, then gathers threat data from internal and public feeds. Exploit-DB serves as the sample data set because its entries are well structured and labeled.

The middle of the talk covers preparing that data. Feeds from different sources use different severity scales, and they often have gaps and empty entries, so the speaker recommends aggregating them, normalizing them to a common scale and checking sparsity. He argues for simple, explainable classical machine learning rather than large models, which also keeps organizational data in-house. Predictions use a distance-based method on roughly the top ten attack vectors, while recommendations use a slope one approach. The workflow is implemented in a Python notebook and profiled for each quarter.

The result is a per-quarter view of the current status, shown with example weightings for remote code execution, injection and authentication bypass. The speaker explains that the output can suggest how to split a budget and which threats to address first. The takeaway for managers is to combine their own feeds with public ones and let simple models surface missing attack vectors that matter to their organization.