Vulnerability Intelligence for All: Say Goodbye to Data Gatekeeping

Teams can typically patch only about a tenth of the vulnerabilities on their network in a given month, so the speaker argues that the real task is choosing which tenth matters. He separates threat intelligence, which covers who is attacking and why and is often sold for large sums, from vulnerability intelligence, which answers what is being exploited, when, and where. Most organizations, he says, need the second far more than the first.

The middle of the talk walks through free sources. CISA's Known Exploited Vulnerabilities catalog is presented as a practical starting point, Metasploit is treated as a list of flaws attackers already have working code for, and the EPSS model from FIRST estimates the likelihood of exploitation within 30 days. Exploit-DB has faded while GitHub proof-of-concept repositories have grown, though many of them only check for a version rather than exploit it. He also argues that CVSS scores are static and do not reflect exploitation, and that proof of exploit, meaning working code from low privilege, matters more than proof of concept.

To close, he introduced a combined list built from CISA, Metasploit and FIRST data, refreshed hourly as a CSV that teams can check against their scanners. In questions, the discussion covered licensing for commercial exploit libraries and how to hand developers a short list of high-priority library updates rather than a long backlog.