Outpacing Attackers: How Data-Driven Insights Speed Up Vulnerability Remediation

Outpacing Attackers: How Data-Driven Insights Speed Up Vulnerability Remediation

Speakers: S Abasi, Vulnerability Research Manager & Product Owner, Qualys

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=tTWQum1epq0

Overview

In an era of rapidly escalating cyber threats and an overwhelming volume of newly disclosed vulnerabilities, organizations face an unprecedented challenge in effectively managing and remediating security flaws. S Abasi, Vulnerability Research Manager and Product Owner at Qualys, presented a compelling data-driven analysis at VulnCon, shedding light on the current state of vulnerability remediation and offering critical insights into how organizations can accelerate their defense against active threats. The talk, titled "Outpacing Attackers: How Data-Driven Insights Speed Up Vulnerability Remediation," underscored the urgent need for a strategic, intelligent approach to vulnerability management rather than simply chasing every alert.

Abasi's presentation leveraged anonymized data from Qualys' extensive customer base, encompassing billions of scans and millions of vulnerability records, to provide a macroscopic view of remediation trends. The core message revolved around the critical gap between attacker weaponization times and defender remediation efforts, emphasizing the importance of risk-based prioritization and integrated security solutions. This talk is highly relevant for security professionals, C-suite executives, and IT operations teams grappling with the sheer scale of vulnerabilities and striving to improve their organization's cyber resilience. It highlights that simply identifying vulnerabilities is no longer enough; effective remediation requires deep context, advanced scoring, and streamlined workflows to truly outmaneuver adversaries.

Background

▶ Watch: Introduction, agenda, and data-driven approach (0:00)

The landscape of cybersecurity is continuously reshaped by an ever-increasing volume of vulnerabilities. Abasi highlighted a significant surge, with over 40,000 vulnerabilities disclosed in 2024, marking a 39% jump from the previous year. This proliferation is attributed to the massive expansion of the attack surface driven by continuous software development, the rapid adoption of cloud technologies, and potentially the advent of AI-driven discovery tools. Historically, similar surges have been observed, such as in 2016-2017 due to the expansion of the CNA program (CVE Numbering Authority) and the emergence of major ransomware attacks like WannaCry and the Equifax breach. Earlier, 2013-2014 saw a 53% jump, fueled by the rise of bug bounty programs like HackerOne and Bugcrowd, alongside high-profile vulnerabilities such as Heartbleed and Shellshock.

Against this backdrop, organizations struggle to identify and prioritize the most critical threats. Traditional vulnerability scoring systems like CVSS (Common Vulnerability Scoring System) often fall short in providing the necessary context for real-world risk. Many vulnerabilities, despite having moderate CVSS scores, are actively exploited in the wild. This challenge led to the creation of initiatives like the CISA KEV (Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities) catalog, which lists vulnerabilities that have been observed under active exploitation. While CISA KEV serves as a crucial prioritization signal, Abasi's data revealed that it's not exhaustive, and many other weaponized vulnerabilities exist outside this list, underscoring the need for broader threat intelligence integration. The fundamental problem persists: attackers are weaponizing vulnerabilities faster than organizations can remediate them, creating a perilous window of exposure.

Key Findings

▶ Watch: Significant surge in CVE numbers (4:00)

Abasi presented several critical data-driven insights from Qualys' research, highlighting the stark realities of vulnerability management:

• Exploding Vulnerability Count: Over 40,000 new vulnerabilities were identified in 2024, representing a 39% increase year-over-year. As of April 2024, the count was 41% higher than the same period last year.
• Weaponized vs. CISA KEV: Qualys identified 245 weaponized CVEs in 2024, meaning they were actively employed in malware campaigns or ransomware. CISA, in comparison, added 186 new CVEs to its KEV catalog during the same period, indicating that the CISA KEV list, while vital, does not capture all actively exploited threats.
• CISA KEV Impact on Remediation: Organizations demonstrate significantly faster remediation for CISA KEVs. A remarkable 64% of CISA KEVs are fixed within 14 days of being added, and 82% are fixed within 30 days. Additionally, 20% of vulnerabilities that eventually make it to the CISA KEV list are already remediated before CISA officially adds them, showcasing a proactive stance by some organizations leveraging advanced threat intelligence.
• The Remediation Gap: On average, organizations take 30.5 days to fix CISA KEV vulnerabilities. However, attackers weaponize vulnerabilities much faster, with an average time of 18.5 days. The median weaponization time is even more alarming at 5.5 days, compared to a median remediation time of 10 days for organizations, creating a critical 4.5-day median exploitation window. Non-CISA KEVs take approximately 4 days longer to fix on average.
• Persistent Exposure: Despite rapid initial remediation, 5% of CISA KEV detections (equating to 25 million instances in Qualys' dataset) remain unfixed after 90 days. Even after 180 days, 1.5% are still open, highlighting long-tail remediation challenges.
• Workload vs. Performance: Remediation speed correlates directly with workload. During months with lower vulnerability detection volumes (e.g., March-April with 20 million detections), teams often fix vulnerabilities even before CISA adds them. In contrast, during peak months (e.g., August with 120 million detections), remediation efforts lag significantly.
• Critical Infrastructure Focus: While critical infrastructure sectors face significant risk, the number of unique vulnerabilities affecting them is relatively low (around 60). However, the instances of these vulnerabilities can be massive (e.g., 34,000 instances per CVE in transportation/healthcare), underscoring the need for automation and targeted prioritization.
• CVSS Insufficiency: Analysis of CISA's routinely exploited vulnerabilities revealed that many had moderate CVSS scores (e.g., 5.5), which IT teams might dismiss. This demonstrates the inadequacy of CVSS alone for effective prioritization.
• Ransomware Group Insights: A leak of 200,000 internal Black Basta ransomware group chats (1.3 million lines of text) identified 62 specific vulnerabilities they actively discussed and exploited. Examining two of these—a Jenkins CVE and a JetBrains CVE—showed median remediation times of 47 and 39 days, respectively, despite CISA specifically tagging them as part of ransomware campaigns. The JetBrains vulnerability was even abused 3 days prior to public disclosure.
• Patch Management Effectiveness: Organizations leveraging patch management tools remediate vulnerabilities significantly faster, sometimes over 20 days quicker than those without, particularly for CISA KEVs.
• Public-Facing VPNs and Secure Access: Adversaries show high interest in public-facing assets, particularly VPNs and secure access solutions. Qualys observed 100,000 instances of VPN-related vulnerabilities. While 42% were fixed quickly, the average remediation time was 39 days, with attackers weaponizing them in an average of 16.5 days, leaving 88% vulnerable during that period.
• Holistic Approach Required: Effective remediation necessitates an integrated platform encompassing comprehensive asset inventory, broad vulnerability detection, intelligent enrichment, risk-based prioritization, and diverse remediation capabilities (patching, mitigation, isolation).

Technical Deep Dive

▶ Watch: Key trends: weaponized CVEs, CISA KEV, internet-facing assets (6:50)

The insights presented by S Abasi are rooted in a substantial dataset and sophisticated analytical methodologies employed by Qualys. The core data set comprised 750 million records of CISA KEV detections, alongside high-risk and critical vulnerabilities not necessarily on the CISA list, all collected from January to December 2024. This data originates from Qualys' average of 6 billion scans per year across its customer base, providing a massive, anonymized pool for analysis. The research focused on 321 unique CVEs disclosed in 2024, examining detection times, vulnerability characteristics, and exploitation data drawn from approximately 25 different threat intelligence feeds ingested by Qualys.

A key aspect of Qualys' technical approach is its proprietary Qualys Vulnerability Score (QVS). Unlike the static, inherent severity reflected by CVSS, QVS is a dynamic, context-aware score assigned to each vulnerability. This score is generated by an algorithm that considers multiple criteria, including:

• The raw CVSS score.
• Whether the vulnerability is part of the CISA KEV catalog.
• If it's related to known ransomware campaigns.
• Discussions and mentions of the vulnerability on the dark web and other threat feeds.
• The existence of public exploits or proof-of-concept code.

This comprehensive approach allows QVS to provide a more accurate and actionable risk assessment than CVSS alone, especially for vulnerabilities that might have a moderate CVSS score but are actively exploited. Abasi demonstrated this by plotting CISA's routinely exploited vulnerabilities, showing how many were rated low by CVSS but high by QVS, clearly indicating their real-world importance.

The analysis of remediation times often utilized techniques akin to survival analysis, a statistical method for analyzing the expected duration of time until one or more events occur. This allowed Qualys to plot the percentage of vulnerabilities fixed over time (e.g., 64% fixed by day 14, 82% by day 30), providing a granular view of remediation velocity. The speaker referenced Jacob's (co-chair of EPSS) blog for technical details on plotting such data.

Furthermore, Qualys integrates its vulnerability intelligence with frameworks like Mitre ATT&CK to map specific CVEs to known adversary tactics and techniques. This mapping provides defenders with a deeper understanding of how a vulnerability might be exploited in the context of a broader attack chain, further enriching the prioritization process. The concept of a "true risk score" was also introduced, which combines the QVS (inherent vulnerability risk) with the criticality of the affected asset within an organization's environment (e.g., a critical asset in the finance department). This holistic scoring helps IT teams understand the true business impact of a vulnerability, driving more effective remediation efforts.

For remediation, the talk highlighted Qualys' "True Risk Eliminate" tool, which goes beyond simple patching. It offers a suite of tested, pre-validated actions like running mitigation scripts, isolating systems, or disabling specific features. These scripts are tested in environments similar to production, providing IT teams with the assurance needed to act quickly without fear of breaking critical systems. This technical capability is crucial for scenarios where immediate patching is not feasible due to end-of-life systems or complex dependencies.

The emphasis on integrated asset inventory and life cycle management is also a technical cornerstone. Abasi stressed that without accurate, up-to-date information on asset status (e.g., whether a system is end-of-life), remediation efforts can be misdirected or impossible. Integrating this data directly into the vulnerability management platform ensures that remediation plans are realistic and effective, preventing scenarios where teams are asked to patch systems for which no patch exists.

Demo / Proof of Concept

▶ Watch: Proactive remediation before CISA KEV listing (10:50)

While the presentation did not feature a live, interactive demonstration of specific tools, S Abasi extensively discussed the capabilities and operational advantages of Qualys' integrated platform, particularly its Qualys True Risk Eliminate solution. This tool serves as a practical manifestation of the data-driven insights presented, aiming to bridge the gap between vulnerability identification and effective remediation.

Abasi explained that Qualys True Risk Eliminate is designed to empower IT teams by offering a range of remediation options beyond traditional patching. Recognizing that patching is not always feasible—especially for end-of-life systems or due to operational constraints—the tool provides alternative mitigation strategies. These include:

• Running Mitigation Scripts: Pre-tested scripts that can reduce the risk associated with a vulnerability without applying a full patch. These scripts are validated in environments mimicking production, providing assurance to IT teams that they won't introduce new problems.
• System Isolation: Capabilities to quickly isolate a vulnerable asset from the network, containing potential exploitation.
• Disabling Features: Options to disable specific vulnerable components or features on a system.
• Uninstalling Software: Functionality to remove problematic software if necessary.

The core value proposition discussed was the assurance provided by Qualys that these alternative remediation actions are thoroughly tested and proven effective. This addresses a common fear among IT teams—the risk of causing system instability or outages when implementing security changes. By providing pre-validated, tested solutions, Qualys True Risk Eliminate aims to remove this barrier, enabling faster and more confident remediation decisions. The speaker also mentioned that Qualys offers an exclusive bundle for VulnCon attendees to test their integrated asset inventory, vulnerability detection, and patch/remediation capabilities, effectively serving as a call to action for a hands-on proof-of-concept experience.

Defensive Implications

▶ Watch: CISA KEV list's global prioritization impact (11:20)

The data presented by S Abasi offers clear, actionable guidance for organizations looking to strengthen their defensive posture against the relentless pace of cyber threats:

1. Adopt Advanced Risk Scoring Beyond CVSS: Relying solely on CVSS is insufficient. Organizations must integrate advanced, context-aware scoring systems like Qualys Vulnerability Score (QVS) or similar methodologies. These systems incorporate real-world threat intelligence, including CISA KEV status, ransomware association, dark web discussions, and exploit availability, to provide a true risk score that reflects the actual likelihood and impact of exploitation. This helps IT teams prioritize vulnerabilities that attackers are actively exploiting, even if their CVSS score is moderate.
2. Prioritize the Top 1% and Remediate Under 5 Days: The data unequivocally shows that attackers weaponize vulnerabilities very quickly (median 5.5 days). To stay ahead, security teams must identify and focus remediation efforts on the most critical 1% of vulnerabilities—those that are actively exploited, weaponized, or reside on critical assets—and strive to fix them within five days. This aggressive target requires streamlined workflows and dedicated resources.
3. Integrate Threat Intelligence Deeply: Beyond CISA KEV, organizations need to ingest and act upon a broad range of threat intelligence feeds. This proactive approach helps identify weaponized vulnerabilities before they are widely publicized or added to official lists, enabling remediation before the broader defender community is even aware.
4. Implement Robust and Automated Patch Management: Patch management is not optional; it's a critical, proactive defense strategy. The data clearly demonstrated that organizations using patch management remediate vulnerabilities significantly faster. Automation should be leveraged to apply patches efficiently, especially for high-volume, critical vulnerabilities.
5. Embrace a Holistic Vulnerability Management Platform: Effective remediation requires an integrated approach that connects:

• Asset Inventory: A comprehensive, up-to-date understanding of all assets, their criticality, and their life cycle management status (e.g., end-of-life). This prevents misdirected remediation efforts and chaos.
• Broad Detection: Multi-faceted detection capabilities including agents, network scanners, and container security to ensure no asset or vulnerability is missed.
• Enrichment and Context: Providing IT teams with the full context of a vulnerability—its risk score, affected asset criticality, and potential impact—to facilitate informed decision-making.
• Prioritization: Automated systems to identify the most critical vulnerabilities based on integrated risk scoring.
• Diverse Remediation: Tools that offer options beyond patching, such as mitigation scripts, isolation capabilities, or feature disabling, especially for unpatchable systems.

1. Fortify Public-Facing Assets: Given the high interest from adversaries, public-facing assets (especially VPNs and secure access solutions) must receive heightened attention. Implement Multi-Factor Authentication (MFA), client certificates, disable unnecessary features, ensure robust log management, and deploy IDS/IPS solutions to monitor and protect these storefronts of an organization.
2. Address Human Factors and Workload Management: The data showed that remediation speed drops significantly under high workload. Organizations need to strategically manage the volume of alerts, using advanced prioritization to ensure teams focus on what truly matters. Education for IT teams on advanced scoring and the real-world impact of vulnerabilities (even those with moderate CVSS scores) is crucial to prevent the neglect of potentially exploitable "mediums" or "highs."

Key Takeaways

• The Pace of Attackers is Faster: Attackers weaponize vulnerabilities in a median of 5.5 days, while organizations take a median of 10 days to remediate, creating a critical window of exposure.
• CISA KEV is Impactful but Not Exhaustive: The CISA KEV list significantly accelerates remediation, but a broader range of weaponized vulnerabilities exist, necessitating comprehensive threat intelligence.
• CVSS is Insufficient for Prioritization: Traditional CVSS scores often fail to reflect real-world exploitation risk; advanced, context-aware scoring systems like Qualys Vulnerability Score (QVS) are essential for effective risk-based prioritization.
• Focus on the Critical Few: Organizations must prioritize the top 1% of truly critical and actively exploited vulnerabilities, aiming for remediation within five days to effectively outpace adversaries.
• Integrated Solutions are Paramount: A holistic approach combining accurate asset inventory, broad detection, intelligent enrichment, automated patch management, and diverse remediation options is crucial for mature vulnerability remediation.
• Public-Facing Assets are Prime Targets: VPNs and other public-facing services are highly targeted and often suffer from slow remediation, requiring dedicated focus and additional security measures like MFA and network segmentation.

About the Speaker(s)

S Abasi is the Vulnerability Research Manager and Product Owner for the Vulnerability Research team at Qualys. His team is instrumental in the discovery and detection of vulnerabilities, with their work feeding into every Qualys product, including risk management and vulnerability management solutions. Comprising around 120 people globally, Abasi's team actively researches and probes vulnerabilities, contributing to the detection capabilities that power Qualys' offerings. They are also known for discovering zero-day vulnerabilities, though they work closely with vendors to ensure patches are available before public disclosure, thus making them "not zero" upon release. A notable achievement includes the discovery of an OpenSSH server vulnerability regression. The team has also been recognized with multiple Pwnie Awards, often referred to as the "Oscars of information security research," for their excellence in the field.