PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Understanding our Risk Score, and why it reflects real-world conditions

ethiack.com | blog | #vulnerability-management | #prioritization | #epss | #ethiack | #kev | #risk-score
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Ethiack explains its rebuilt Risk Score, which weighs exploitability context — CISA KEV and EPSS data, asset exposure, and time ignored — instead of CVSS severity alone to prioritize vulnerabilities.
Published
Collected

Related coverage

blog · borghq.io
How to Prioritise Security Findings That Have No CVE
CVSS, EPSS and KEV are all built around published CVEs, so they cannot score findings in your own application code. This practical guide shows how to rank exploitable issues like tenant boundary flaws in a continuous testing queue.
blog · ethiack.com
Full Walkthrough: Ethiack 2.0
Ethiack 2.0 walkthrough: real-time Risk Exposure Score, attack-surface management, on-demand human hacking events, exportable executive reports, and 24/7 vulnerability management.
blog · hackerone.com
Elevate CVE Remediation with EPSS, Now Integrated in HackerOne Hacktivity
HackerOne integrated EPSS into Hacktivity's CVE Discovery, letting teams combine CVSS severity with FIRST's 30-day exploit probability predictions to prioritize CVE remediation more accurately.
blog · netspi.com
Are You Flooded With Vulnerabilities?
NetSPI argues risk-based prioritization is key to vulnerability floods, proposing a five-phase lifecycle of discovery, correlation, verification, prioritization, and remediation to close the fix gap.
vulnerability · projectdiscovery.io
The Coverage Lie: Why Current Vulnerability Scanners Fail to Stop Breaches
Legacy scanners fail from untrusted version-based guesses, not coverage gaps: only ~6% of CVEs are exploited, yet weaponization is fast. Runtime validation plus KEV focus yields actionable results.
blog · ethiack.com
Ethiack's Spring Release: What's New and What's Coming
Ethiack's spring release recap: a 50% faster Hackian agentic pentester, authenticated on-demand pentests behind login walls, Beacon v2 for internal assets, and an exploitability-based risk score.
Back