Beyond Whack-a-Mole: Scaling Vulnerability Management by Embracing Automation

The talk looks back at vulnerability scanning in the early 2000s, when scanner databases held only a couple of thousand entries and about 25 new vulnerabilities appeared each week. Today the count is around 260,000 entries, with close to 800 added weekly. Many organizations still rank work by CVSS base scores, a measure of severity rather than real-world risk, even though only a small share of vulnerabilities is ever exploited.

The middle section walks through discovery, assessment, prioritization and remediation. The speaker proposes comparing SBOMs generated at different lifecycle stages to surface gaps, and gathering asset, business, threat, runtime and remediation context in one place. CSAF is presented as a machine-readable format for security advisories, and VEX as a way to record whether a product is actually affected and why. A worked example shows how reachability, network exposure and configuration checks can narrow one flaw's hundred instances to a single item. SSVC, a decision-tree method, is introduced as a transparent way to weigh several risk factors.

The takeaway is to define how risk is measured in your organization, starting with a few decision points, and to automate the evidence behind them. During questions, the speaker noted that auditors often still demand patching by CVSS threshold, and argued that explainable, data-driven evidence is needed to shift that expectation.