We humans aren’t very good at judging risk. We never needed to be.
That may sound like a strange thing to say about our species that has managed to survive for a very long time. But think about how we evolved.
Our ancestors were walking through the wilderness, when suddenly they heard something in the bushes.
There might be a lion in there. There might not be.
They had two choices. Assume there was no lion and keep walking. Or you assume there was a lion and get out of there fast. One misjudgement has a very different consequence than the other.
Evolution drove us towards a simple answer. Prioritize our fear of the lion. It was a good strategy to improve our odds for survival. It was not necessarily a good strategy for accurately measuring risk.
We have carried that instinct into most every facet of our lives, including cybersecurity.
For decades, we have built an industry around finding more things to be afraid of. More vulnerabilities. More alerts. More attack paths. More warnings about what might happen next.
The problem is that possibility and probability are not the same thing.
That is what we set out to examine in The Vulnpocalypse Report. We looked at thousands of vulnerabilities exploited in the real world and asked what the evidence actually tells us about risk.
The data is fascinating.
For the last couple of years, we have been told that AI has fundamentally changed the adversary. The barrier to entry is collapsing. Zero-day development is going exponential. Time-to-exploit is collapsing to hours. The AI attacker's singularity has arrived.
These weren't predictions about some distant future. These things were already happening, people said.
So we looked at the data.
CVEs have exploded. That is absolutely true. But the adversary didn't publish those CVEs. We did.
The things that actually matter look different. The rate of exploited vulnerabilities has not suddenly gone vertical. Zero-days have not broken out of their historical range. We don’t see the massive change in adversary behavior we were told was already happening.
That doesn't mean AI won't change offensive security. It means we should stop confusing what AI can do with what attackers are actually doing. I suspect we're going to watch people change their story in real time.
First it will be, “It’s already here.”
Then it will be, “It just needs more time.”
And when the predicted catastrophe still doesn't arrive, it will become, “See? Our warnings worked.” Either way, they win.
That's not a prediction. A useful prediction has to tell us what should change, by how much and by when. Otherwise, it is just a story that can survive every outcome. There is another lesson in the data that matters for security teams.
We have treated vulnerabilities as though their risk can be determined independently of context. A vulnerability gets a 9 CVSS score, so we call it critical.
But a 9 is not a 9.
Some vendors’ vulnerabilities are exploited far more often than others. Some classes of vulnerabilities show up in real-world attacks far more often than others. That means vulnerability management will have to get more specific. A vulnerability from one vendor may need to be patched faster than an identically scored vulnerability from another. The same goes for vulnerability classes.
We have never really designed vulnerability management this way. We're going to have to. And there is another prioritization problem coming.
AI will make vulnerability discovery dramatically cheaper and faster. Eventually, there will be more potential vulnerabilities to look for than anyone can practically scan, investigate and remediate. Prioritization won’t just mean deciding what to fix first. It will mean deciding what to look for at all.
The cybersecurity industry has spent decades getting better at finding lions. Now we need to get better at figuring out which bushes actually contain one. That means moving from a culture of fear to a culture of outcomes. Some organizations will make that leap. Some won't.
Survival is optional.
And the companies that spend the right amount on the right things at the right time are going to have a pretty significant advantage over the ones that keep running from every noise in the bushes.