Loading…
Saturday April 5, 2025 2:00pm - 2:50pm EDT
CVE, CVSS, EPSS, exploit-ability, reach-ability, risk based scoring, AI, lol..we use a bewildering and growing number of complex methods in an attempt to identify which CVEs are the ones that present the greatest technical or business risk. CVE volume increases year by year and some of our methodologies were developed in prior decades, when CVE volume was a fraction of what is is today. We can't predict which CVEs are going to go 'hot' in the future - but what if we could? This is the story of the NOFATE project, which is part of the SKYNET project for eliminating alert fatigue at scale. NOFATE has, since Jan. 3, published sixteen correct predictions on CVEs being added to a KEV watchlist, with early warning times as long as 30 - 50 days. If we can predictively micro-target the few 'superhot' CVEs for action quickly, around the same time they are released, we could be doing intrusion prediction, and incident avoidance, rather than doing threat detection and incident response in a series of CVE and incident fire drills. The predictions are published on GitHub.
Speakers
avatar for Craig Chamberlain

Craig Chamberlain

Security Researcher, CyberDyne Labs
Craig Chamberlain has been working on threat hunting and detection for most of his life. He has contributed to several products you may have used. He has been a principal at six startups, four of which had successful exits, and including four security products. He dis extensive work... Read More →
Saturday April 5, 2025 2:00pm - 2:50pm EDT
Track 2, 5 Wayside Rd 5 Wayside Rd, Burlington, MA 01803, USA

Log in to save this to your schedule, view media, leave feedback and see who's attending!

Share Modal

Share this link via

Or copy link