PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Calculate Return on Mitigation (RoM) With Hai

hackerone.com | blog | #ai-security | #vulnerability-management | #security-metrics | #hackerone | #hai | #return-on-mitigation | #ai-copilot | #risk-quantification
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne's AI copilot Hai now auto-calculates Return on Mitigation (RoM) for resolved reports, quantifying the losses avoided by fixing vulnerabilities before exploitation.
Published
Collected

Related coverage

blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · hackerone.com
A Call for a New Cybersecurity Measurement Standard
HackerOne argues ROI fails to capture cybersecurity's value because security prevents losses rather than generating revenue, and proposes Return on Mitigation (RoM) as the new metric.
blog · netspi.com
Metrics: Your Security Yardstick – Part 2 – Defining Metrics
Follow-up on building security metrics: map controls to requirements, pull data from reliable sources like vulnerability management tools, then combine low-level metrics into higher-level indicators.
incident · hackerone.com
ROI Isn’t Cutting It: 6 Questions to Help CISOs Better Quantify Security Investments
HackerOne introduces Return on Mitigation (ROM), which counts mitigated losses as returns instead of net profit, and offers six questions to help CISOs quantify security investments.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · hackerone.com
Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase
HackerOne ran Anthropic's Mythos 5 model against its own production code; it surfaced a critical RCE spanning three safe-in-isolation commits, illustrating compositional risk that diff review misses.
Back