Risk Prioritization

This talk addresses the critical challenge of prioritizing which of thousands of unpatched vulnerabilities pose the highest risk. The speaker introduces a DARPA-funded approach developed by Object Security that combines hybrid static-dynamic analysis with symbolic AI to identify and verify potential vulnerabilities in firmware images, particularly for embedded devices, legacy systems, and firmware without source code access.

The problem is significant: over 26,000 vulnerabilities were discovered in 2023 alone, yet most organizations rely on traditional approaches that simply connect asset inventory to published CVEs and rank by severity. This leaves uncertainty about which high-risk vulnerabilities actually exist in a specific environment.

The novel approach uses three complementary analysis layers: (1) Static analysis examines complete firmware images without requiring source code, suitable for end-of-life or legacy devices; (2) Dynamic analysis identifies memory vulnerabilities and weak pointers; (3) Symbolic execution uses AI to convert software facts and rules into logical symbols, enabling abstract reasoning to verify weaknesses and predict potential zero-days.

Key capabilities include detecting weak pointers and exploitation paths, verifying exploitability through symbolic reasoning, automatically mapping discovered CWEs to compliance frameworks (IEC 62443, NIST 853/882), providing code hardening recommendations, and checking against known exploits (KEVs).

Two scenarios illustrate prioritization: Scenario 1 shows high-confidence weak pointer detection with verified exploitability paths and receives high priority; Scenario 2 identifies potential weak pointers but cannot verify exploitability due to uncertainty about false positives, receiving lower priority.

Processing time varies by firmware complexity: sensors take minutes, PLCs can take up to one day on Kubernetes clusters, and HMIs take moderate processing time. The speaker presents workflows for asset owners (analyzing legacy devices and verifying patches before deployment) and for DevOps/manufacturers (integrating into CI/CD pipelines). The solution is currently deployed in nuclear environments and manufacturing facilities, handling both traditional firmware and web-based industry 4.0 devices. It uses a proprietary training corpus rather than third-party data, addressing privacy concerns.