Building a risk-based vulnerability management program that scales
Asimily CEO Shankar Somasundaram outlines a risk-based vulnerability management approach using inventory, attack paths, KEV and EPSS data.
In a Help Net Security video, Asimily CEO Shankar Somasundaram argues patching everything is infeasible as AI-driven attacks inflate vulnerability counts, with one customer finding a thousand unknowns for each known one. He recommends building a full inventory of devices, applications, and data flows, mapping attack paths for reachability, and prioritizing with KEV, EPSS, and business impact. Mitigations include patching, virtual patching via NACs and firewalls, segmentation, and configuration snapshots to detect drift.
- Two-thirds of published CVEs are marked high risk, weakening CVSS-based triage
- Prioritize by reachability, exploitability data, and business impact
- Virtual patching and segmentation shrink the blast radius
From the original article
1 min read at helpnetsecurity.com
In this Help Net Security video, Shankar Somasundaram, CEO at Asimily , explains how to build a risk-based vulnerability program. He notes that vulnerabilities are exploding by an order of magnitude in the age of AI-driven attacks , with one customer finding a thousand vulnerabilities for every one they knew about.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.