Organizational Context Matters: Security Control Effectiveness on Vulnerabilities for Prioritization

Organizational Context Matters: Security Control Effectiveness on Vulnerabilities for Prioritization

Speakers: Ertugrul Yaprak, Solutions Architect, Picus Security; Mehmet Kiliç, VP of Research, Picus Security

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=b1-XjLTOKtE

Overview

In an era defined by an ever-increasing deluge of vulnerabilities, security teams are perpetually overwhelmed, struggling to prioritize and remediate threats effectively. Mehmet Kiliç and Ertugrul Yaprak from Picus Security addressed this critical challenge at VulnCon, presenting a compelling framework for vulnerability prioritization that incorporates organizational context and the actual effectiveness of in-place security controls. Their talk, "Organizational Context Matters: Security Control Effectiveness on Vulnerabilities for Prioritization," argues that traditional vulnerability scoring methods, such as CVSS, are insufficient on their own because they fail to account for the unique defensive posture of each organization.

The core of their presentation revolves around moving beyond theoretical risk to an evidence-based approach. By leveraging attack simulation platforms and an extensive action library, organizations can validate whether their security controls genuinely protect against specific attacker techniques. This validation then informs a more accurate, contextualized risk score, allowing security teams to strategically focus their limited resources on vulnerabilities that truly pose an exploitable threat within their specific environment. The speakers demonstrated how this methodology can drastically re-prioritize vulnerability lists, shifting focus from a broad sea of high-severity alerts to a refined subset of critical, unblocked exposures.

Background

▶ Watch: The overwhelming problem of vulnerability prioritization (0:00)

The sheer volume of newly disclosed vulnerabilities presents an insurmountable challenge for most organizations. Kiliç opened the talk by highlighting sobering statistics: in the last year, approximately 132 new vulnerabilities were published daily, a number that escalated to 166 daily in the first quarter of 2024. Alarmingly, nearly 50% of these vulnerabilities are classified as high or critical severity, with projections indicating over 50,000 new vulnerabilities will emerge in the current year. This constant influx means organizations are battling an ever-growing backlog; one collaborative customer, for instance, discovered 43 new CVEs daily in their environment, accumulating nearly 29,000 unique CVEs, translating into millions of vulnerability instances when considering asset-level deployment.

Further compounding the problem is the speed at which vulnerabilities are exploited. Statistics from One Identity, cited by Kiliç, indicate that 28% of new vulnerabilities can be exploited within 24 hours of disclosure. This rapid exploitation window demands immediate, precise action, yet security teams are often paralyzed by the sheer volume of alerts. Traditional vulnerability management largely relies on Common Vulnerability Scoring System (CVSS) scores, which provide a standardized, theoretical measure of a vulnerability's severity. However, CVSS scores are generic; they do not consider an organization's specific defensive technologies, configurations, or operational context. An organization might invest millions in security controls—firewalls, endpoint detection and response (EDR), web application firewalls (WAFs), and hardening policies—yet these investments are often not factored into the prioritization process, leading to misallocated resources and continued exposure to exploitable threats. The fundamental problem, as articulated by the speakers, is the disconnect between the theoretical risk presented by a vulnerability and the actual, effective risk given an organization's defensive capabilities.

Key Findings

▶ Watch: The need for a vulnerability action library (11:40)

The talk unveiled several crucial findings that challenge conventional vulnerability management practices:

• CVSS Alone is Insufficient for Prioritization: Generic CVSS scores fail to incorporate the unique organizational context, including the presence and effectiveness of deployed security controls. This leads to an inflated perception of risk and inefficient resource allocation.
• Security Control Effectiveness is a Critical Prioritization Factor: Organizations invest heavily in security controls, but their actual effectiveness against specific vulnerabilities is rarely measured and integrated into prioritization. An evidence-based approach, validating control efficacy, is essential.
• Attack Simulation Provides Actionable Evidence: Real-world attack simulations are key to understanding whether a vulnerability is truly exploitable within an environment and if existing security controls can detect or prevent the associated attacker actions. This transforms theoretical risk into empirically validated exposure.
• AI-Driven Mapping Enhances Efficiency and Standardization: Manually mapping thousands of CVEs to specific attacker actions is time-consuming and inconsistent. AI agents can automate this process, creating accurate, standardized mappings with confidence scores, significantly accelerating vulnerability assessment.
• Contextual CVSS Offers a More Accurate Risk Score: By modifying environmental CVSS metrics (Attack Vector, Attack Complexity, Privileges Required) based on validated security control effectiveness, organizations can derive a unique, context-aware CVSS score that reflects their actual risk posture.
• The Exposure Score Enables Operational Prioritization: A comprehensive Exposure Score, which combines contextual CVSS, business criticality, exploitability, and a direct measure of security control effectiveness, provides a practical, weighted formula for operationalizing vulnerability remediation efforts.
• Prioritization Shifts Dramatically with Context: Applying this methodology can significantly reduce the perceived number of high and critical vulnerabilities, while simultaneously elevating the prioritization of seemingly lower-severity vulnerabilities that are genuinely unblocked and exploitable in the environment.

Technical Deep Dive

▶ Watch: AI mapping a critical AD vulnerability to specific actions (16:00)

The proposed solution hinges on a multi-faceted technical approach designed to bridge the gap between theoretical vulnerability scores and real-world defensive capabilities.

The Action Library

At the heart of Picus Security's methodology is a comprehensive action library, a repository of 30,000 distinct attacker actions. These actions are derived from analyzing real-world threats, attacker samples, and behaviors, meticulously crafted to simulate various attack techniques in a risk-free manner. The library is not limited to known exploits but encompasses a broad spectrum of attacker tactics, techniques, and procedures (TTPs), from initial access and execution to privilege escalation and data exfiltration. Each action in the library is detailed with specific payloads, technique IDs (e.g., MITRE ATT&CK), and mapped CWE codes, providing a granular understanding of how an attacker might attempt to exploit a vulnerability. This library serves as the baseline for evaluating security control effectiveness.

AI Agent for CVE-to-Action Mapping

Given the immense volume of CVEs and the extensive action library, manual mapping is impractical. The speakers highlighted that manual mapping is not only time-consuming (up to an hour or more per CVE) but also highly dependent on the individual researcher's expertise, leading to potential inconsistencies. To overcome these limitations, Picus Security developed an AI agent that automates the mapping process.

This agent intelligently searches through CVE contexts and the action repository, identifying and matching CVEs with relevant attacker actions. Unlike simple keyword searches, the AI agent understands the context of both the vulnerability description and the action's behavior, leading to more accurate matches. Each mapping produced by the AI agent includes a confidence score and a brief reasoning, allowing security analysts to validate the suggested mappings. This automation significantly reduces mapping time (often a minute or less per CVE) and ensures a standardized methodology, irrespective of the analyst.

An illustrative example was provided for CVE-2021-42278, an Active Directory Domain Services vulnerability with a high severity score. This CVE involves attackers exploiting a security flaw when creating delegated or group managed service accounts to escalate privileges and gain domain control. The AI agent mapped this CVE to three actions, ordered by confidence score:

1. Enumerate Bad Successor Vulnerability Exploitation: This action directly mimics the core exploitation technique of creating child processes on managed service accounts to escalate privileges. It was found to have a 99% average blocking ratio in simulated environments, indicating high effectiveness of controls against this specific technique.
2. Enumerate Group Managed Service Accounts: While not a direct exploit, this action represents a crucial reconnaissance step before exploiting the vulnerability. It had a lower blocking ratio, with nearly 50% of environments failing to block it, highlighting a potential blind spot.
3. Target Active Directory Domain Services (Alternative Technique): This action targets the same product (Active Directory) but uses a different technique. Although less directly related to the CVE's specific method, it was still suggested by the AI agent due to product scope and impact similarity, achieving a 95% blocking ratio.

This example demonstrates how the AI agent provides a nuanced understanding of control effectiveness against various facets of a single vulnerability's exploitation chain.

Contextual CVSS Calculation

The core innovation in risk scoring is the concept of Contextual CVSS. Instead of inventing a new scoring algorithm, the speakers proposed leveraging the environmental metrics already defined within the CVSS framework. Specifically, they focused on three key metrics:

• Attack Vector (AV): Describes the necessary conditions for exploitation (e.g., Network, Adjacent, Local, Physical).
• Attack Complexity (AC): Describes the complexity of the attack (e.g., Low, High).
• Privileges Required (PR): Describes the level of privileges an attacker needs to exploit the vulnerability (e.g., None, Low, High).

When an organization's security controls are proven effective against an attacker action, these environmental metrics are dynamically modified. For instance, if a network perimeter solution blocks a remote attack (Network AV), the effective attack vector for that organization might shift to "Adjacent Network" or even "Local," reflecting that an attacker would need to be inside the network or have local access to exploit it. Similarly, if controls make an attack significantly harder, the Attack Complexity can be elevated from "Low" to "High."

Example 1: N8N Remote Code Execution Vulnerability

This web-based vulnerability (CVSS Base Score 10) involves a malicious web request. If a WAF or network solution protects against this specific action, the Attack Vector might change from "Network" to "Adjacent Network," and Attack Complexity could increase from "Low" to "High" due to the controls. This re-calculation could reduce the Contextual CVSS from 10 to 8, reflecting the reduced risk for that specific organization.

Example 2: Active Directory Domain Services Vulnerability (CVE-2021-42278)

With a CVSS Base Score of 8.8, this endpoint-related vulnerability involves privilege escalation. If endpoint security controls effectively block the necessary attacker actions, the Attack Complexity might increase, and Privilege Required might change. Although the Attack Vector might not change (as it's still an endpoint attack), these adjustments could reduce the Contextual CVSS from 8.8 to 8.1.

These examples illustrate how Contextual CVSS provides an organization-specific risk score, distinct from the generic base score, by reflecting the effectiveness of their unique security solutions.

The Exposure Score

While Contextual CVSS provides a refined risk score, the speakers introduced the Exposure Score as the ultimate operational prioritization metric. This score combines multiple critical factors, offering a holistic view of true organizational exposure:

Exposure Score = (Weight_1 Base CVSS) + (Weight_2 Contextual CVSS) + (Weight_3 Business Criticality) + (Weight_4 Exploitability) + (Weight_5 * Security Control Effectiveness)

The components are:

• Base CVSS: The standard, generic severity score.
• Contextual CVSS: The organization-specific CVSS score adjusted by control effectiveness.
• Business Criticality: An organizational input reflecting the importance of the affected asset or system (defined by the organization).
• Exploitability: A measure of how easily the vulnerability can be exploited (e.g., presence of public exploits, attacker skill required).
• Security Control Effectiveness (SCE): This is explicitly included again as a separate component, even though it influences Contextual CVSS. The rationale is that Contextual CVSS reflects the risk score reduction, but SCE here represents the operational success rate of controls against all mapped actions for a given CVE. As Ertugrul noted, a vulnerability might have a Contextual CVSS reduction from 8.8 to 8.1, but if the primary exploitation path is 99% blocked, this high effectiveness needs to be explicitly weighted for operational prioritization.

Each component is assigned a customizable weight, allowing organizations to tailor the formula to their specific risk appetite and priorities. The Exposure Score offers a dynamic and actionable metric that not only de-prioritizes vulnerabilities effectively blocked by controls but can also increase the prioritization of seemingly lower-severity vulnerabilities if they are critical to business operations and remain unblocked by existing defenses. This allows teams to focus on the vulnerabilities that truly matter and pose an immediate threat.

Demo / Proof of Concept

▶ Watch: Adapting CVSS scores based on environmental security controls (23:00)

The speakers demonstrated the practical application of their methodology using data from a collaborative customer's environment. This real-world proof of concept vividly illustrated the transformative impact of incorporating organizational context into vulnerability prioritization.

Initially, when looking at the base CVSS distribution for the customer's vulnerabilities, a significant portion—68%—were categorized as high or critical severity. This is a common scenario that overwhelms security teams.

However, after applying the contextual CVSS calculation, which factors in the effectiveness of the customer's specific security controls, the distribution shifted dramatically. The percentage of vulnerabilities categorized as high or critical was reduced to 54%. This 14 percentage point reduction in the most severe categories immediately provides relief and a more realistic view of the organization's risk landscape, allowing teams to focus on a smaller, more manageable set of genuinely high-risk issues.

Furthermore, the talk emphasized that the Exposure Score takes this contextualization a step further for operational prioritization. While contextual CVSS might reduce a score from 10 to 8, or 8.8 to 8.1, the Exposure Score can highlight instances where even a medium-severity vulnerability might become a top priority. This occurs if the vulnerability impacts a business-critical asset, has high exploitability, and crucially, is not effectively blocked by existing security controls. The speakers showed that some low or medium-severity vulnerabilities could be elevated to critical status in the Exposure Score, compelling immediate attention because they represent a clear, unmitigated path for attackers. Conversely, a high-severity vulnerability that is 99% blocked by controls would be appropriately de-prioritized. This dynamic re-prioritization ensures that remediation efforts are aligned with actual organizational exposure, rather than just theoretical threat levels.

Defensive Implications

▶ Watch: Q&A: Understanding the action library's scope and updates (34:00)

This advanced approach to vulnerability prioritization offers several critical implications for security defenders:

• Shift from Generic to Contextual Risk: Defenders must move beyond relying solely on generic CVSS scores. Integrating organizational context—specifically the proven effectiveness of security controls—is paramount for understanding true risk.
• Invest in Attack Simulation Capabilities: Organizations should invest in or leverage attack simulation platforms like Picus Security. These platforms provide the evidence-based validation necessary to assess whether security controls actually prevent or detect specific attacker actions related to vulnerabilities. This moves security posture assessment from theoretical compliance to empirical efficacy.
• Develop or Adopt an Action Library: Establishing a comprehensive library of attacker actions and TTPs is fundamental. This library allows security teams to map vulnerabilities to concrete attack behaviors, enabling precise testing of defensive capabilities.
• Integrate Control Effectiveness into VM Workflows: Security control effectiveness data should be systematically integrated into existing vulnerability management and prioritization workflows. This could involve enriching vulnerability scanner outputs or feeding simulation results into GRC platforms.
• Prioritize Based on Exposure, Not Just Severity: Remediation efforts should be prioritized using a metric like the Exposure Score, which combines contextual CVSS, business criticality, exploitability, and the explicit effectiveness of security controls. This ensures resources are focused on vulnerabilities that are most likely to be exploited and cause significant business impact.
• Continuously Validate and Monitor: Security controls are not static; their effectiveness can degrade over time due to configuration drift, new attack techniques, or updates to software. Continuous validation through attack simulations is essential to maintain an accurate understanding of the organization's true exposure.
• Improve Communication with Leadership: By presenting risk in terms of actual exposure and control effectiveness, security teams can have more meaningful conversations with leadership, demonstrating the value of security investments and justifying remediation efforts based on tangible data.

Key Takeaways

• CVSS alone is insufficient: Traditional CVSS scores provide a generic, theoretical risk assessment that fails to account for an organization's unique defensive posture.
• Organizational context is paramount: Incorporating the effectiveness of in-place security controls, along with business criticality, is crucial for accurate vulnerability prioritization.
• Attack simulation provides evidence: Real-world attack simulations are essential for validating whether security controls truly protect against specific attacker actions and exploit techniques.
• AI-driven mapping enhances efficiency: AI agents can efficiently and consistently map vast numbers of CVEs to a comprehensive library of attacker actions, overcoming the limitations of manual processes.
• Contextual CVSS and Exposure Score refine prioritization: By adjusting CVSS environmental metrics and integrating multiple factors into an Exposure Score, organizations can achieve a more precise and actionable prioritization of vulnerabilities.
• Focus on true exposure: This approach enables security teams to shift focus from a broad list of high-severity alerts to a refined subset of critical vulnerabilities that are genuinely unblocked and exploitable within their environment.

About the Speaker(s)

Ertugrul Yaprak and Mehmet Kiliç are key figures at Picus Security, a leading provider of Breach and Attack Simulation (BAS) solutions. Mehmet Kiliç, as the VP of Research, leads the team responsible for developing the extensive action library and the methodologies for mapping vulnerabilities to attacker behaviors. Ertugrul Yaprak, a Solutions Architect, focuses on how these advanced security concepts can be practically applied to help organizations improve their security posture. Their expertise lies in understanding attacker techniques, simulating real-world threats, and translating that intelligence into actionable insights for vulnerability management and security control optimization.