Epoch Theory of Cyber

Epoch Theory of Cyber

Speakers: Jeremiah Grossman, Chief Executive Officer, Root Evidence

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=BaziaareilY

Overview

In his Black Hat MEA talk, "Epoch Theory of Cyber," Jeremiah Grossman, CEO of Root Evidence, presented a compelling framework for understanding and anticipating the evolution of the cybersecurity threat landscape. Drawing upon over 25 years of experience at the forefront of the industry—from pioneering application security to predicting the rise of ransomware and attack surface management—Grossman articulated a mental model designed to empower security leaders. This model, the Epoch Theory of Cybersecurity, posits that by analyzing attacker incentives, behavioral patterns, and evolutionary cycles, organizations can gain foresight into future threats and proactively prepare their defenses.

Grossman's unique perspective, honed through direct experience with some of the most significant shifts in cyber threats, underscores the critical importance of strategic anticipation. He argues that the industry's current reactive stance is unsustainable and often misdirected. Instead, a data-driven, incentive-focused approach, informed by the adversary's predictable evolution, is essential for truly turning the tide against cybercriminals. The talk served as both a retrospective on past successes in threat anticipation and a forward-looking call to action, particularly emphasizing a revolutionary approach to vulnerability management.

Background

▶ Watch: Hacking Yahoo in 1999 and starting in cybersecurity (1:00)

Jeremiah Grossman's journey in cybersecurity began uniquely, not in a traditional academic or corporate setting, but through a personal quest to understand system vulnerabilities. As a 20-year-old Unix administrator in 1999, his hobby of "breaking software" led him to successfully compromise his own Yahoo Mail account—and by extension, 120 million others—in just five minutes. This act, reported responsibly to Yahoo, unexpectedly landed him his first cybersecurity job: hacking Yahoo 24/7 for two years. This foundational experience instilled in him a deep understanding of offensive tactics and the adversary's mindset, which he later leveraged to build successful startups and advise major organizations.

Grossman's career has been marked by a consistent ability to foresee major shifts in the threat landscape. He was instrumental in establishing application security as a critical domain around 2000, recognizing that traditional network firewalls were becoming obsolete as attacks moved up the software stack to web applications. His company, White Hat Security, focused on scaling application security, developing systematic methods to "hack all applications at all times" to identify vulnerabilities.

Later, in 2015, Grossman anticipated the rise of ransomware while joining SentinelOne. He observed the inherent scalability issues of signature-based antivirus solutions, where the effort to create new viruses remained flat while the effort for antivirus companies to keep up with signatures grew exponentially. The emergence of Bitcoin provided adversaries with a new, anonymous monetization channel for system infections, leading to the predictable shift towards encrypting systems for ransom. SentinelOne pivoted to using machine learning (ML) and artificial intelligence (AI) to track the behavior of malware rather than relying on signatures, a strategy that led to the largest IPO in cybersecurity history at the time.

By 2017, conversations with Digital Forensics and Incident Response (DFIR) teams revealed another critical blind spot: 30% to 50% of breaches were not due to unpatched known vulnerabilities, but because organizations were unaware that the compromised systems even existed. Adversaries were exploiting unknown or unmanaged assets, often internet-facing, that were outside the scope of traditional security programs. This insight led Grossman to anticipate the need for Attack Surface Management (ASM), founding Bit Discovery, which famously downloaded entire copies of the internet daily to map organizations' digital footprints.

These experiences crystallized into the Epoch Theory of Cyber, a mental model describing the predictable evolution of adversaries:

1. Manual: Hands-on keyboard, individual attacks.
2. Scripts/Tools: Development of simple tools to repeat manual processes.
3. Scale (Internet Scale): Exploiting one or two vulnerabilities across the entire internet. Grossman notes that much of the current threat landscape operates at this stage.
4. Complexity/Obfuscation: When pushed by defenses, adversaries introduce advanced techniques like polymorphic viruses to evade detection.

Grossman emphasizes that adversaries are sentient, not random acts of nature. They chase incentives and will only shift their tactics when forced by effective defenses. He categorizes adversaries into three classes: activists (who hack and make their presence known), cybercriminals (who hack for financial gain, locking down systems and stealing data), and nation-states (highly targeted, sophisticated, purpose-driven, often seeking command and control over critical infrastructure).

He outlined three fundamental rules in cybersecurity that are often forgotten:

1. If something can be hacked, it doesn't mean it will be hacked.
2. Adversaries chase incentives.
3. When defenses meet the adversary's capabilities, the adversary has four choices: stop, choose softer targets, innovate, or migrate to a totally new attack style. The goal of defenders, Grossman asserts, is to force these shifts, particularly innovation or migration, which signals progress in the ongoing cyber war.

Key Findings

▶ Watch: Current vulnerability management challenges: cost, volume, prioritization (10:40)

Jeremiah Grossman's deep dive into the current state of vulnerability management (VM) revealed a system fundamentally broken and inefficient. His two years of intensive research, including over 200 meetings with CISOs and VM teams globally, exposed several critical flaws:

1. Overwhelming Volume of CVEs: The ecosystem currently contains over 300,000 cataloged CVEs (Common Vulnerabilities and Exposures), creating an impossible task for organizations to address them all.
2. Cost-Prohibitive Scanning: Modern vulnerability scanning is so resource-intensive that, for many large organizations, the cost of scanning everything they own every day actually exceeds the expected financial loss from a breach. This paradox means security measures are often more expensive than the risks they are designed to mitigate, making comprehensive scanning economically unfeasible.
3. Unmanageable Backlog: VM teams are "buried in more vulnerabilities than they have ever hoped they can ever fix." The common advice to "patch more, patch faster" is a "fantasy" given the sheer volume of issues.
4. Ineffective Prioritization: Existing vulnerability scoring models, such as CVSS (Common Vulnerability Scoring System) and EPSS (Exploit Prediction Scoring System), are demonstrably ineffective. Grossman states, "none of it actually works. It's worse than flipping a coin to try to figure out which vulnerability to fix when." This lack of reliable prioritization leads to misallocated resources and continued exposure to critical threats.
5. Lack of Justification for Remediation: Companies struggle to justify the cost and time required to fix an issue relative to the perceived cost of leaving it unexploited. This economic calculus often results in critical vulnerabilities remaining unpatched for extended periods.

To address these systemic failures, Grossman turned to actuarial data from cyber insurance carriers and incident responders—the entities with the most direct, real-world experience of breaches and their financial impact. Their insights revealed startling findings:

• Primary Breach Causes: Approximately 50% of all cyber incidents are the direct result of remote CVE exploitation. The other half are attributed to credential stuffing, identity attacks, and phishing. This highlights that effective vulnerability management could halve breaches and financial losses.
• The "Exploited in the Wild" Reality: Out of the 300,000+ total CVEs, only a minuscule 1.1% (approximately 3,000 to 4,000 vulnerabilities) have ever been observed exploited in the wild, according to data from Vone. This dramatically narrows the scope of truly relevant vulnerabilities.
• The Critical Few: Even more critically, cyber insurance carriers and DFIR teams report that on any given year, only 20 to 200 specific vulnerabilities are responsible for the vast majority of breaches and financial losses they see. Grossman emphatically states, "if we wipe out these 200 vulnerabilities that we're not aware of yet, we can reduce breaches and financial loss by 50%."
• The Unknown Asset Problem: Roughly 30% of breaches are linked to organizations' lack of knowledge about their own internet-facing assets. Adversaries exploit systems that companies don't even know they own, underscoring a fundamental gap in attack surface management.
• Adversary Tactics are Not Novel: Contrary to popular belief, adversaries are largely not innovating with highly sophisticated, cutting-edge techniques (e.g., advanced AI-powered attacks). Instead, the "99% signal" indicates they are primarily scaling old, known attacks against a broad range of systems. They frequently exploit vulnerabilities dating back to 2008, not just the latest zero-days or CVSS 10 scores. Grossman notes, "If our security strategies are to fix the CVSS10s from the last two years, we will get hacked and we will have losses."
• Existing Tools are Sufficient: With rare exceptions, the industry already possesses the necessary tools, technology, and concepts to fix most prevalent issues. The problem lies not in capability, but in misaligned incentives and a lack of focus on what truly matters.
• Actuarial Data as the North Star: The future of cybersecurity strategy must be guided by actuarial data from cyber insurance and incident response. This data helps narrow the focus from all possible risks to probable risks, enabling organizations to make impactful security investments.

Technical Deep Dive

▶ Watch: Only 20-200 vulnerabilities truly cause breaches (14:20)

The core of Grossman's "Epoch Theory of Cyber" lies in understanding the evolutionary stages of the adversary and how defensive strategies must adapt to force these shifts. As detailed in the background, these stages progress from manual, hands-on keyboard attacks, to the use of simple scripts and tools for repeatability, then to internet-scale attacks leveraging a few vulnerabilities across a vast target base. The final stage, complexity and obfuscation (e.g., polymorphic viruses), is only adopted when adversaries are sufficiently pushed by robust defenses. Grossman asserts that much of the current threat landscape is dominated by adversaries operating at the "scale" epoch, focusing on known, older vulnerabilities.

The talk highlighted the technical failings of current vulnerability management (VM) practices, particularly in light of the adversary's predictable behavior. Traditional VM struggles with the sheer volume of CVEs. With over 300,000 cataloged vulnerabilities, the reactive approach of attempting to patch everything is not only impractical but also economically unviable. Grossman provided a historical parallel with antivirus solutions in 2015, where signature-based detection became unscalable. The shift to machine learning (ML) and AI for behavioral tracking, as implemented by SentinelOne, demonstrated a necessary technical pivot when signature-based methods failed. Similarly, for VM, simply generating more alerts or chasing every new CVSS 10 is an unscalable and ineffective strategy.

Grossman's research into prioritization models like CVSS and EPSS reveals their technical shortcomings in predicting actual exploitability or impact. The data shows these models are "worse than flipping a coin," leading security teams to prioritize vulnerabilities that are never exploited in the wild while neglecting those that are actively used by attackers. This is a critical technical disconnect; the technical metrics often fail to align with the operational reality of adversary behavior.

The proposed solution is a radical shift towards a data-driven, actuarial approach, focusing on a drastically smaller, yet more impactful, set of vulnerabilities. This requires a technical infrastructure capable of:

1. Comprehensive Asset Discovery: Organizations must first solve the problem of identifying all their internet-facing assets. This is a complex technical challenge that requires continuous scanning and mapping of the global internet, as demonstrated by Bit Discovery's approach of "downloading entire copies of the internet every single day." Without a complete inventory of the attack surface, any vulnerability management effort will have critical blind spots (the "30% unknown asset" problem).

1. Targeted, High-Frequency Scanning: Instead of scanning for 300,000+ CVEs, the focus should be on the 20 to 200 vulnerabilities that cyber insurance carriers and DFIR teams identify as actively exploited and responsible for the majority of financial losses. This implies a need for highly efficient, targeted scanners that can perform daily scans of all internet-facing assets. Grossman envisions a system capable of scanning "100,000 assets every 60 seconds" for this specific, critical set of vulnerabilities. This speed and focus are essential to maintain currency against adversaries who scale older exploits.

1. Actuarial Risk Prioritization: The technical output of vulnerability scanning must be integrated with actuarial data to provide a clear financial justification for remediation. This means aligning the "cost of remediation against the cost of financial loss." Security tools need to move beyond raw technical scores and provide business-relevant metrics that quantify the return on investment for patching specific vulnerabilities. This involves understanding not just the technical severity, but the probability of exploitation and the financial impact of a breach.

1. Cost Reduction in Security Operations: A critical technical goal is to reduce the unit cost of security, particularly vulnerability scanning, by "10x cheaper than what it is." Current enterprise scanning solutions are often too expensive to run comprehensively and continuously across modern, large-scale environments. Achieving this requires innovations in scanning technology, efficiency, and potentially leveraging cloud-native architectures or new scanning paradigms.

Grossman emphasizes that adversaries are not waiting for zero-days; they are effectively leveraging a long tail of older vulnerabilities. His data shows that a significant portion of breaches involve vulnerabilities from as far back as 2008, with 35 vulnerabilities from 2005 and 66 from 2004 still contributing to current breaches. This technical insight directly challenges the industry's often myopic focus on the latest, highest-scoring vulnerabilities, advocating instead for a strategy informed by actual exploitation patterns. The technical deep dive reveals that the solution is less about inventing new security primitives and more about intelligently applying existing capabilities based on a clear understanding of adversary economics and behavior.

Demo / Proof of Concept

▶ Watch: Actuarial data will guide security investments and focus (18:40)

This talk presented a strategic framework and a call to action rather than a live technical demonstration or proof of concept. Jeremiah Grossman's presentation focused on a mental model and data-driven insights to reshape cybersecurity strategy, particularly in vulnerability management. While he referenced the successful implementation of these principles in companies like White Hat Security, SentinelOne, and Bit Discovery, no specific tools or live exploits were demonstrated during the session.

Defensive Implications

▶ Watch: Three goals for future vulnerability management: speed, cost, balance (19:30)

The "Epoch Theory of Cyber" and its associated data-driven insights offer profound implications for defensive strategies, urging a fundamental shift from reactive, comprehensive patching to proactive, risk-prioritized remediation.

1. Shift from "Possible" to "Probable" Risks: Defenders must move away from the overwhelming task of addressing all possible vulnerabilities (300,000+ CVEs) and instead focus on the probable risks identified by actuarial data from cyber insurance carriers and DFIR teams. This means concentrating efforts on the 20 to 200 vulnerabilities that are actively exploited and demonstrably lead to breaches and financial losses.
2. Prioritize Actively Exploited CVEs over CVSS Scores: Security teams should de-emphasize generic vulnerability scores like CVSS and instead prioritize remediation based on real-world exploitation intelligence. This includes historical data showing that adversaries frequently leverage older vulnerabilities (some dating back to 2008) rather than exclusively chasing new zero-days or CVSS 10 scores. A strategy solely focused on the latest high-severity CVEs is insufficient and leaves organizations exposed to well-understood, older attack vectors.
3. Master Attack Surface Management (ASM): Given that 30-50% of breaches stem from unknown or unmanaged assets, organizations must invest heavily in robust Attack Surface Management capabilities. This involves continuously discovering and cataloging all internet-facing assets to eliminate blind spots that adversaries readily exploit. If you don't know you own it, you can't protect it.
4. Implement Daily, Targeted Scanning: Vulnerability scanning needs to evolve from infrequent, broad scans to daily, highly targeted assessments focused on the critical 20-200 actively exploited vulnerabilities. This requires more efficient and cost-effective scanning technologies to ensure comprehensive, continuous coverage without exceeding the financial benefits of prevention.
5. Re-evaluate Security Spending with ROI: Security leaders must be able to justify the cost of remediation by aligning it directly with the financial loss avoided. This requires integrating security metrics with business risk and financial impact, enabling CISOs to answer critical questions from boards and CEOs about where to spend security budgets for maximum impact.
6. Understand and Disrupt Adversary Incentives: By addressing the prevalent, scaled attacks that adversaries currently favor, defenders can force them to expend more effort, choose softer targets, or innovate. This strategic approach aims to elevate the adversary to the next epoch of complexity, making their attacks less efficient and more costly, thereby "winning the war against hackers."
7. Embrace Behavioral Detection over Signatures: Drawing from the success of SentinelOne against ransomware, defenders should continue to favor behavioral analysis and machine learning (ML) approaches over static signature-based detection for evolving threats. This allows for adaptability against new attack variations without requiring constant signature updates.

By adopting these defensive implications, organizations can move from a state of being overwhelmed by "all possible risks" to a focused, data-driven defense that strategically addresses "probable risks," ultimately enhancing their security posture and optimizing resource allocation.

Key Takeaways

• The Epoch Theory of Cyber provides a mental model for understanding how adversaries evolve from manual attacks to scaled, internet-wide campaigns, and eventually to complex, obfuscated methods, driven by incentives.
• Current Vulnerability Management (VM) is broken: it's overwhelmed by 300,000+ CVEs, suffers from cost-prohibitive scanning, ineffective prioritization models (like CVSS/EPSS), and a lack of financial justification for remediation.
• Actuarial data from cyber insurance carriers and incident responders reveals that only 20-200 actively exploited vulnerabilities (out of 300,000+) are responsible for approximately 50% of all breaches, not the latest zero-days or high-scoring CVEs.
• Defenders must shift focus to Attack Surface Management to identify all internet-facing assets and implement daily, targeted scanning for these critical 20-200 actively exploited vulnerabilities, aligning remediation costs with financial loss prevented.
• Adversaries primarily scale known, often older vulnerabilities (some dating back to 2008) rather than consistently innovating with new sophisticated techniques; security strategies must adapt to this reality instead of solely chasing the latest high-severity alerts.
• The cybersecurity industry needs to drastically reduce the unit cost of security products and operations by 10x, enabling comprehensive, continuous protection that is economically viable and justifiable through clear financial impact.

About the Speaker(s)

Jeremiah Grossman is the Chief Executive Officer at Root Evidence, bringing over 25 years of profound experience and recognized foresight in the cybersecurity industry. His career began unconventionally in 1999 when he, as a Unix administrator, successfully hacked Yahoo Mail, leading to his first cybersecurity role as an in-house hacker for Yahoo. Since then, Grossman has been a pivotal figure in anticipating and shaping the industry's response to emerging threats.

He is widely acknowledged for his instrumental role in establishing application security as a critical domain at his company, White Hat Security. He later joined SentinelOne in 2015, where he anticipated the rise of ransomware and championed the shift towards behavioral detection using machine learning, contributing to the company's historic IPO. His foresight also led him to anticipate the need for Attack Surface Management (ASM), culminating in the founding of Bit Discovery. Grossman is also known for building "the largest private hacker army" and having a "get out of jail free card" to ethically hack major financial institutions and government entities in the U.S., experiences that have deeply informed his understanding of adversary motivations and capabilities.