Navigating Challenges of Risk-Based Vul. Mgmt. in a Cloud World

The session opens with the problem: vulnerability volumes have grown into the hundreds of thousands, disclosure-to-exploitation windows have shrunk to days, and teams often juggle several scanners that each produce their own severity score. The speakers argue that spreadsheet-driven, severity-first triage leaves engineers frustrated and executives without shared context. They also note that asset ownership is often unclear, so findings reach the wrong team and stall.

The middle of the talk lays out a risk-based model. The presenters describe consolidating and deduplicating findings from different tools, then enriching them with exploit evidence, internet exposure and business criticality. They trace a vulnerability's lineage from source code through build files, artifacts, containers and registries, so the fix lands with the owner who can actually change it. Reachability analysis is used to set aside issues that cannot be triggered in the running environment. A funnel built from their own results shows the set of critical findings shrinking to a small fraction of the starting count.

The closing section frames the approach as collaboration between security, engineering and business sponsors. It suggests drawing ownership data from existing service catalogues rather than asking engineers to file tickets by hand. Practitioners should take away the idea of stewardship for assets, prioritizing by context rather than raw score, and measuring outcomes in time and effort saved. One of the presenters, speaking from a vendor position, also outlines product features for AI-assisted remediation.