Cybersecurity is Ready for Local Models

Michael Roytman, a data scientist who has built decision-support models for security vendors, opens by arguing that most enterprises are not generic. He points out that vulnerability scores such as CVSS and EPSS are global models: they score the same CVE identically in every environment, even though what matters is what is actually running on a given network.

The middle of the talk compares remediation strategies by efficiency and coverage against known exploitation data. Using public and vendor exploitation telemetry, he shows that CVSS-based cutoffs demand heavy remediation work for modest risk reduction, and that EPSS performs better. A model trained on exploitation telemetry improves further. A simulated enterprise-specific model that uses local prevalence, where one vulnerability appears across many assets, comes much closer to realistic results. He also notes that some vulnerabilities remain hard to predict and that remediation effort varies widely between systems.

He closes by urging teams to feed scan results, configuration data, endpoint telemetry, past incidents and ticketing history back into their own risk models rather than relying on vendor scores alone. The practical takeaway is to measure any scoring strategy against your own environment using efficiency and coverage curves. He acknowledges that data engineering is the hard part, but argues that building such models in-house is increasingly achievable.