Digital Shadows (now ReliaQuest)’ new vulnerability intelligence capability brings a unique context to CVEs. Armed with this intelligence, security teams can better prioritize their vulnerability management efforts.
Beyond CVSS Scoring
More than 20,000 vulnerabilities were reported in 2021 – vulnerabilities that attackers are rapidly incorporating into their campaigns. When new vulnerabilities are announced, speed of response is critical. Unfortunately, security teams do not have sufficient information to effectively prioritize these efforts.
For many organizations, CVSS provides a way to prioritize and focus response efforts. However, even reducing the team’s focus to the CVEs with the highest CVSS scores leaves potential thousands of vulnerabilities to focus on. Worse still (and as discussed in our newly-published Vulnerability Intelligence Solutions Guide) CVSS scores fail to provide an accurate picture of the true risk. This means that you might be ignoring a low scored CVE that is being exploited by threat actors, or focusing on “high risk” vulnerabilities that have never been exploited.
Others have fused CVSS with crude measures of “buzz”, by monitoring how often a CVE or alias is mentioned on the internet. This adds little value without an assessment of the reliability of the source, and understanding the context of the mention.
Vulnerability intelligence provides insight into how any given CVE is being used, traded, or discussed across the threat landscape, including source assessments and easy to interpret risk factors. Armed with this intelligence, teams can better decide how to respond.
Bringing Intelligence Expertise to Vulnerability Management
Given its importance, vulnerability intelligence is fast emerging as one of the most sought after intelligence capabilities. Unfortunately, existing solutions fall short for one of three reasons.
- Limited visibility. Important information about vulnerabilities can surface across a wide range of online locations. Vulnerability and exploit database, code repositories, pastes sites, social media, criminal forums, vendor websites, security researchers, and various messaging channels. Solutions that only provide visibility into a small number of these sources will miss vital information.
- Ambiguous scoring. Solutions will re-score vulnerabilities with observed threat activity, but the new score is unhelpfully ambiguous. It can be impossible to know exactly why a given vulnerability has been scored higher or lower.
- Data, not intelligence. Solutions that rely on bulk collection, automated feeds, and keyword matching serve to overwhelm security teams. Instead of focusing on the most important vulnerabilities, you are drawn to the CVEs attracting the most hype.
It’s now time to go beyond basic keyword matching to provide genuine intelligence expertise to vulnerability management.
The SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) Solution
SearchLight’s new Vulnerability Intelligence module provides access to the industry’s most comprehensive intelligence on vulnerabilities, outlining how they are being exploited, interest levels, and mitigation advice.
A dedicated team of vulnerability intelligence analysts combine automated collection with their own continuous monitoring. Any mention of a CVE is properly investigated, unnecessary noise is removed, and reliability of the authors is assessed. Our team identifies associated risk factors, such as if it has been advertised for sale, embedded in a pen test tool, or used by a threat actor. These risk factors drive a transparent risk score,supported by the necessary evidence.
Within the portal (or via the API), users can search for CVEs, CPEs, product families and vulnerability aliases to get intelligence on specific areas of interest.
Key Features
- Filter by exploit availability, CVSS vector, threat actor interest, and mitigations.
- Intuitive dashboard with rich CVE profiles
- Full access to finished cyber threat intelligence associated with CVEs
- Related intelligence, curated by Digital Shadows (now ReliaQuest) Research Team
- Accessible via API or cloud-based portal
Get Started Today
Curious to know more about how SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) can help? Schedule a demo to see our new capability in action!
Not ready to talk? Check out our Vulnerability Intelligence Solutions Guide instead.