Calculating Risk in the Era of Obscurity: Reading Between the Lines of Security Advisories

## Overview

Presented by Brian Gorenc (Senior Director of Vulnerability Research at Trend Micro and head of the Zero Day Initiative) and Dustin Childs (Senior Community Communications Manager and patch specialist at ZDI), this talk addresses how modern vendor patching and disclosure practices introduce operational and security risks to enterprises.

Drawing from ZDI’s extensive background—including running the world's largest vendor-agnostic bug bounty program, adjudicating Pwn2Own, and disclosing over 10,000 vulnerabilities to vendors since 2005—the speakers highlight a disturbing trend in recent years: a noticeable decline in patch quality coupled with reduced transparency and communication surrounding security updates.

## The Patching Dilemma and Exploit Economics

While applying patches remains one of the single most effective ways to lower the risk of security incidents and breaches, the operational reality of enterprise IT makes immediate patching difficult: - Organizations regularly contend with being "understaffed, underfunded, and under pressure." - Vendors release massive volumes of updates on regular schedules (e.g., typical monthly Patch Tuesdays with roughly 120 vulnerabilities from Microsoft and 50 from Adobe). - Faulty patches and poor advisories force enterprises into misallocating defensive resources, inadvertently raising their exposure to compromise. - Faulty or incomplete patches serve as a boon to exploit writers. Finding zero-days is labor-intensive, whereas developing n-day exploits against flawed or documented patches is significantly easier. Consequently, many organizations now bypass standard vendor recommendations and develop their own prioritization frameworks or rely on third-party intelligence.

## Limitations of CVSS in Enterprise Risk Calculation

A central point of failure in risk assessment is over-reliance on CVSS base scores alone to determine patching urgency. The speakers identify several fundamental shortcomings: - **Subjectivity and Human Bias:** CVSS scores are determined by humans whose biases affect ratings. Discrepancies often emerge between how vendors perceive risk and the reality of deployed environments. As an example, an Amazon Linux vulnerability involving sensitive data exposure via HTTP headers was rated 9.8 by Amazon Linux, but evaluated at 5.9 by Tenable based on real-world factors. - **Lack of Exploitability Context:** CVSS does not capture real-world exploitation likelihood. Citing research by the Cyentia Institute, the RAND Corporation, and Virginia Tech, the speakers note that only **5.5%** of disclosed vulnerabilities are ever detected in the wild. - **Absence of Asset and Environmental Context:** CVSS fails to distinguish whether a vulnerability affects 15 systems or 15 million systems, whether the affected asset is internet-facing, or whether the service is mission-critical to the specific enterprise. - **Uniformity of Severity Scores:** Identical scores do not represent equivalent threat levels. A CVSS 10.0 unauthenticated remote code execution (RCE) vulnerability in a widely adopted mail server like Microsoft Exchange or Exim attracts immediate, aggressive threat actor interest, whereas the same RCE severity in legacy software like SquirrelMail garners vastly less exploit attention.

## Takeaways for Security Leaders

Security leaders and CISOs cannot assume a CVSS score alone dictates operational risk. Organizations must incorporate threat intelligence, deployment architecture, asset criticality, and actual exploitation likelihood into their vulnerability management processes rather than blindly triaging patches by nominal vendor severity metrics.