Vulnerability Haruspicy: Picking Out Risk Signals from Scoring System Entrails

Overview: The speaker critiques the cybersecurity industry's reliance on standardized vulnerability scoring frameworks, comparing modern vulnerability prioritization to ancient "haruspicy" (divining the future from animal entrails). The presentation evaluates how security teams struggle to assess operational risk using the Common Vulnerability Scoring System (CVSS), the Exploit Prediction Scoring System (EPSS), and CISA's Known Exploited Vulnerabilities (KEV) catalog. By analyzing the statistical properties, operational blind spots, and systemic biases within these scoring systems, the talk provides a practical framework for identifying authentic risk signals rather than dogmatically following numerical scores.

Key Topics: - Critique of vulnerability scoring systems: CVSS vs. EPSS vs. CISA Known Exploited Vulnerabilities (KEV) - Statistical analysis and limitations of CVSS severity scoring and environmental metric estimation - Predictive exploit forecasting using the Exploit Prediction Scoring System (EPSS) and real-world threat correlation - Risk-based vulnerability management: integrating threat intelligence, asset exposure, and software reachability

Technical Details: Enterprise vulnerability management teams face an overwhelming influx of newly published CVEs, often defaulting to numerical severity thresholds to drive patching SLAs. The speaker demonstrates that the Common Vulnerability Scoring System (CVSS) measures theoretical technical severity rather than actual risk. CVSS base metrics—such as Attack Vector (AV), Attack Complexity (AC), Privileges Required (PR), and Scope—are frequently assigned inconsistently across vendors and NVD analysts. Consequently, vulnerabilities with critical CVSS scores (9.0+) often require unrealistic environmental prerequisites or non-standard configurations, creating severe remediation fatigue while distracting teams from genuinely exploitable lower-severity bugs.

To inject probabilistic forecasting into remediation workflows, the FIRST consortium created EPSS (Exploit Prediction Scoring System). EPSS employs machine learning models trained on real-time threat intelligence, proof-of-concept repositories, and dark web activity to predict the probability that a CVE will experience in-the-wild exploitation within 30 days. While EPSS significantly improves remediation efficiency compared to CVSS alone, the speaker explains that low EPSS percentiles can generate false confidence, particularly when zero-day weaponization occurs rapidly before threat intelligence feeds can update the model's feature weights.

The presentation compares these frameworks against CISA's KEV catalog, which provides deterministic validation of active in-the-wild exploitation. However, KEV is purely reactive, capturing attacks only after widespread exploitation has been confirmed. The speaker demonstrates that effective "vulnerability haruspicy" requires moving beyond single-metric thresholds to synthesize multiple operational signals: filtering high-probability EPSS scores, verifying presence on CISA KEV, validating software reachability and local network exposure, and cross-referencing real-time exploit availability within public offensive frameworks.

Key Takeaways: Single-dimension vulnerability scores like CVSS represent technical severity rather than contextual business risk, leading to inefficient patch allocation and organizational burnout. Security organizations must transition to threat-informed, risk-based vulnerability management by synthesizing CVSS severity, predictive models like EPSS, and deterministic feeds like CISA KEV. Security teams should prioritize remediation based on asset reachability, internet exposure, and verified exploit availability rather than adhering strictly to static CVSS-driven timelines.

(AI summary — Gemini Flash)