TIPS: Unveiling cybersecurity impact the role of published security findings in strengthening...

### Overview In this talk, Sławek Jonkowski, a Senior Staff Data Scientist at Tenable with a background in security response at Symantec and Broadcom, presents a data-driven retrospective analysis assessing the real-world impact of published cybersecurity threat reports. Threat reports consume considerable industry effort, but Jonkowski sought to measure whether organizations actually react to them—such as by scanning for vulnerabilities, applying patches, or removing affected software—beyond just media publicity.

### Key Topics Jonkowski analyzed an initial corpus of 2,264 public threat reports published between 2010 and 2024. Across this dataset, he extracted 498 mentions of CVEs, representing 1,316 total CVE instances and 449 unique CVEs. Comparing these unique vulnerabilities against approximately 256,000 published CVEs during the same timeframe revealed that the probability of any given CVE being exploited by APTs or ransomware groups in these reports was roughly 1 in 570 (~0.18%). The analysis noted that while threat report volume and CVE exploitation have steadily increased over the years, the systematic use of CVEs by ransomware groups surged notably starting around 2018.

### Technical Details & Methodology To evaluate organizational impact, Jonkowski correlated threat report publication dates with telemetry from Tenable's vulnerability detection systems (including authenticated, agent-based, and unauthenticated scans). Because Tenable detects weaknesses rather than active exploitation, impact was measured through shifts in detection patterns: - A decrease in detections indicates remediation (remediation via patching or uninstallation). - An increase in detections indicates organizations reacted by expanding scan coverage, adopting new scan profiles, or leveraging newly released detection plugins. - Jonkowski therefore defined 'impact' as any noticeable change (increase or decrease) around the report publication date versus a flat, unchanging baseline.

For deep analysis, Jonkowski focused on the completed year of 2023, tracking 92 distinct CVEs across 60 threat reports (with sufficient telemetry data available for 38 reports): - **Software Impact Disparities:** Detection impact varied heavily by software category. Operating systems (Linux kernel, macOS), web browsers, and web servers (such as Apache, Nginx, Tomcat, and WebLogic) showed a 100% impact rate, where reports reliably triggered immediate scanning and patching. Development frameworks and tools (e.g., Apache Struts, Log4j, Spring MVC) also saw high impact, while general enterprise Microsoft software stood around 74%, and broader Windows software hovered near 54%. Conversely, utility/open-source tools categorized as 'other' (such as WinRAR) frequently saw low or delayed impact. - **Report Characteristics:** The reports with the strongest impact tended to be comprehensive annual or multi-operation reports, those mentioning multiple CVEs, or reports explicitly citing ransomware or APT groups in their titles. The publisher's geographical location, organization size, and even language did not hinder impact; for example, a report written in Chinese containing CVEs in an appendix still drove significant patching activity for web browser flaws. - **Exceptions & Anomalies:** Certain reports showed zero measurable impact (e.g., vulnerabilities in Zimbra Collaboration Suite or Windows Search). In cases like Zimbra, investigation suggested the flaws had already been patched prior to report publication, or lacked telemetry in certain customer regions.

### Takeaways The study demonstrates that threat reports tangibly drive enterprise remediation and scanning behavior, even when reports are perceived as marketing-heavy or published in non-English languages, because automated extraction tools successfully capture actionable CVE identifiers. However, organizational patching attention remains heavily skewed toward core infrastructure, servers, and browsers, often leaving standalone client utilities neglected. Jonkowski recommends moving toward unified, standardized threat reporting formats (such as STIX) and centralized sharing repositories to help threat hunters and researchers process and act on findings more effectively.