Towards Effective & Scalable Vulnerability Management

The talk opens by questioning how organizations prioritize vulnerabilities today. The speaker argues that published vulnerability counts keep climbing while remediation capacity lags far behind, and that relying on CVSS base scores is neither scalable nor a good proxy for real risk, since severity measures technical impact rather than whether a flaw will actually be exploited. A short audience poll at the start gauged how many attendees depend on CVSS alone.

The middle section builds up layers of context that can narrow the workload. An SBOM provides the inventory baseline, while exploitability signals such as EPSS and known-exploited catalogs, vulnerability attributes like attack vector, and environmental factors such as compensating controls and reachability add further filters. The speaker then introduces CSAF, a machine-readable security advisory format, and VEX, which lets vendors state whether a product is affected by a given vulnerability and what action is recommended. An SSVC-style decision tree is presented as a way to combine these inputs into act, attend or track decisions.

The closing part frames the result as a funnel: scanner output is reduced through VEX statements and then through the decision tree, so teams start with the work that reduces the most risk and move down the list. The takeaway is to move toward a risk-based vulnerability management program and to automate the steps that are still manual and time-consuming.