Remediation-Aware Reachability: Patching Containers, Prioritizing with Agentic-CTI, and Scaling...

Remediation-Aware Reachability: Patching Containers, Prioritizing with Agentic-CTI, and Scaling...

Speakers: Francesco Cipollone, Founder & CEO, Phoenix Security

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=KXNi0oLXbEw

Overview

In an era defined by the relentless acceleration of cyber threats and the pervasive influence of artificial intelligence, traditional vulnerability management (VM) programs are struggling to keep pace. Francesco Cipollone's talk at VulnCon, "Remediation-Aware Reachability: Patching Containers, Prioritizing with Agentic-CTI, and Scaling...", addresses this critical challenge head-on. Cipollone, drawing from 15 years of experience in vulnerability and cloud security, argues that the sheer volume and velocity of new vulnerabilities, compounded by AI-driven exploitation and code generation, demand a fundamental shift in defensive strategies.

The core of Cipollone's presentation is a call to empower defenders with AI-driven intelligence and contextual awareness. He debunks the hype surrounding AI as a "one-shot vulnerability" solution, instead advocating for its intelligent application as a tool to augment human capabilities. The talk introduces Phoenix Security's Phoenix Blue platform, an open-source threat intelligence system designed to provide high-quality, real-time data for prioritizing vulnerabilities, understanding their reachability, and facilitating rapid, even automated, remediation.

This article delves into Cipollone's insights, exploring the current landscape of escalating threats, the limitations of conventional VM, and the transformative potential of an AI-augmented, data-driven approach. It highlights the critical need for context, attribution, and a focus on actively exploitable vulnerabilities in production environments, offering practical implications for security teams grappling with the "AI apocalypse" in vulnerability management.

Background

▶ Watch: Introduction: AI's impact on vulnerability management (0:00)

The current state of vulnerability management is one of profound crisis and burnout. Cipollone paints a stark picture: over 300,000 new vulnerabilities are declared annually, with a 25% year-on-year acceleration. Since 2015, the number of declared vulnerabilities has increased by a staggering 40x (04:00). This exponential growth is largely attributed to the shift towards modern software development practices, including the widespread adoption of containers and ephemeral assets, which introduce new, complex attack surfaces that traditional VM approaches simply cannot handle (05:00-06:00).

Adding to this complexity is the transformative, and often alarming, impact of Artificial Intelligence (AI). AI is not just a theoretical threat; it's actively reshaping the exploitation landscape. Cipollone notes that the time to exploitation for new vulnerabilities has plummeted from weeks to mere hours or even minutes. He cites examples like the JetBrains vulnerability, which saw exploitation just 3 minutes after declaration, and the Axios vulnerability, which went from initial trigger to massive exploitation in just 4 hours (10:00, 21:00). This acceleration is fueled by AI's ability to generate malicious code, with estimates suggesting that 80-90% of modern codebases are now AI-generated (11:00). Furthermore, AI is being used by attackers to generate convincing but entirely fabricated vulnerability reports, leading to defender fatigue and confusion, as exemplified by the maintainer of curl temporarily taking down their HackerOne disclosure program due to a deluge of "BS reports" (12:00).

The prevailing vulnerability management paradigm, characterized by scanning, triaging, ticket creation, manual patching, and verification, is no longer viable in this high-speed, AI-driven environment (20:00). The sheer volume of alerts overwhelms security teams, leading to burnout (06:00). A critical failing of traditional approaches is their lack of context, attribution, and reachability analysis. Without knowing who owns a particular asset, where a vulnerability resides (e.g., in a base image versus a running container), and whether it's actually reachable from a network or application perspective, security teams are left sifting through mountains of undifferentiated alerts (14:00-16:00). This often results in a focus on raw vulnerability counts rather than prioritizing the critical, exploitable issues that truly matter in production systems (17:00).

Key Findings

▶ Watch: AI's role in exploitation and code generation (10:00)

Cipollone's talk underscores several critical findings that redefine the landscape of vulnerability management in the AI age:

1. Explosive Vulnerability Growth and Velocity: The number of vulnerabilities is accelerating at an unprecedented rate, with over 300,000 new vulnerabilities annually and a 25% year-on-year increase. This trajectory suggests reaching 1 million vulnerabilities well before 2030 (04:00, 07:00). More critically, the time to exploitation has drastically shrunk from weeks to sub-days, with some exploits emerging within minutes or hours of a vulnerability's public disclosure (10:00, 21:00).

1. AI's Double-Edged Sword: AI is profoundly impacting both offensive and defensive security. On the offensive side, AI accelerates the generation of code (up to 80-90% of modern codebases are AI-generated) and the creation of exploits. However, AI also contributes to noise, with the proliferation of fake vulnerability reports that mislead and exhaust defenders (11:00-12:00). For defenders, AI must be leveraged intelligently to match the speed of attackers, acting as a force multiplier for human capabilities rather than a replacement (12:00).

1. Fragility of the Software Supply Chain: Package management ecosystems (e.g., NPM) are identified as highly vulnerable and frequently targeted. Major attacks like Shai Halud, which compromised 800,000 packages, and Axios, which embedded 100 million vulnerabilities daily in JavaScript, highlight this systemic fragility (08:00, 37:00). These types of vulnerabilities often exploit maintainers or use sophisticated dynamic, late-time exploitation tactics that traditional scanning tools miss (08:00-09:00).

1. Limitations of Traditional Vulnerability Data: A significant portion of critical supply chain vulnerabilities, particularly those in package managers, never make their way into the National Vulnerability Database (NVD) (38:00). This means reliance solely on CVSS scores or NVD data leaves organizations blind to a vast and dangerous attack surface. Furthermore, NVD data often lacks crucial enrichment such as CWE (Common Weakness Enumeration) and CAPEC (Common Attack Pattern Enumeration and Classification), hindering effective threat actor and technique mapping (26:00).

1. The Paramount Importance of Context and Attribution: Raw vulnerability counts are meaningless without context. Cipollone emphasizes four crucial questions for effective VM: who owns the asset, where the problem truly lies (e.g., application vs. base image), if it's reachable from an attacker's perspective, and what metrics are truly effective (14:00). He demonstrates how the same vulnerability can yield vastly different CVSS scores (e.g., 6.6 in software, 8 in pipeline, 9.8 at runtime) depending on its context, underscoring the need for context-aware prioritization (16:00). Data-driven attribution and contextualization are proven to be the most effective levers for reducing Mean Time to Resolution (MTTR) (18:00).

Technical Deep Dive

▶ Watch: Announcing Phoenix Blue: Open-source threat intelligence platform (24:00)

The core technical solution presented by Cipollone centers on a data-driven approach to vulnerability management, leveraging AI and robust threat intelligence to achieve remediation-aware reachability. This involves moving beyond simplistic CVSS scores to a nuanced understanding of risk based on context, attribution, and real-time threat intelligence.

At the heart of this approach is the Phoenix Blue platform, an open-source Threat Intelligence Platform (TIP). Phoenix Blue is designed to address the shortcomings of traditional vulnerability intelligence by:

1. Massive Data Ingestion and Processing: It collates 20 years of threat intelligence, vulnerability assessments, and agentic assessments. The platform processes an astounding 2 million advisories and 100 gigabytes of data on an hourly basis, ensuring near real-time intelligence (24:00, 26:00).

1. Re-indexing and Enrichment of NVD: Recognizing the limitations of the NVD, Phoenix Blue has re-indexed the entire 343,000 vulnerabilities within the NVD. This re-indexing enriches each entry with detailed CWE, CAPEC, and TTP (Tactics, Techniques, and Procedures) information, allowing defenders to move from generic vulnerability IDs to understanding specific threat actors and their methods (27:00-28:00). This enables a more granular assessment of whether a vulnerability is applicable to a specific industry or sector.

1. LLM-Driven Intelligence Extraction with Consensus: To combat the hallucination issues prevalent in large language models (LLMs), Phoenix Blue employs a sophisticated LLM architecture. It uses LLMs to extract intelligence from advisories and other sources, but critically, it then uses other LLMs as judges to validate the output and ensure accuracy. A consensus LLM then reconciles any disagreements, ensuring high-quality, trustworthy information (24:00, 41:00). This tiered approach is crucial for generating reliable intelligence from the vast and often noisy data landscape.

1. Hybrid Scoring System for Prioritization: Phoenix Blue's scoring system is a blend of predictive analytics and real-time reactive intelligence. It aims to differentiate "paper tigers"—vulnerabilities with high CVSS scores but no evidence of exploitation or remote triggerability—from "tier one classes" that are actively exploited, accelerating in use, or leveraged by ransomware groups (31:00). The system classifies vulnerabilities into four granular categories:

• Tier 1: Actively exploited, fast-acting, used by threat actors in ransomware or large-scale exploitation, and accelerating in use.
• Emerging: Potentially bad for a specific industry, often repeat offenders like Ivanti or Fortinet.
• Hot & Popular: Confirmed threat, with evidence of exploitation and accelerating.
• Enterprise Watch: Critical vulnerabilities without current exploitation evidence but with high potential to move into other categories due to past patterns or widespread adoption (32:00-36:00).

This scoring is based on a comprehensive set of factors, including:

• Evidence of exploitation: Confirmed in-the-wild activity.
• Prediction of likelihood: Leveraging models like EPSS (Exploit Prediction Scoring System) but not solely relying on them (30:00, 48:00).
• Acceleration of exploit: Rapid increase in exploitation activity.
• Time to exploitation: How quickly exploits emerge after disclosure.
• Base severity: Traditional CVSS, but contextualized.
• Blast radius: Potential impact of exploitation.
• Popularity of POCs: Not just existence, but evidence of active development and sharing (forks, comments) (33:00-34:00). An LLM is used to validate if a Proof of Concept (POC) is real and usable, not just AI-generated text (34:00).
• Threat type and impact: Linking vulnerabilities to ransomware or specific attack patterns.
• End-of-life status: Recognizing risks associated with unsupported software.
• Bug bounty intelligence: Collaboration with platforms like Bugcrowd to gather real-time insights into active exploitation in private programs (34:00-35:00).

1. OSS Metric Scoring System for Package Management: To address the specific challenges of the software supply chain, Phoenix Blue introduces an OSS Metric Scoring System. This system is tailored for package management vulnerabilities (e.g., NPM, PyPI) that often bypass NVD reporting (38:00). It utilizes a neural network with 77 parameters to detect exploitation, particularly late-stage exploitation where malicious code only triggers under specific conditions in the CI/CD pipeline (40:00). This system enables a "firewall" approach, blocking problematic packages from entering development pipelines.

1. Agentic Remediation: The ultimate goal is to move from intelligence to automated action. Phoenix Security's broader platform includes Phoenix Orange for organization and reachability analysis, and Phoenix Green for remediation. Phoenix Green leverages LLMs for "one-shot" automated remediation, capable of fixing entire libraries and performing regression testing, significantly reducing Mean Time to Fix (MTTF) (44:00). This is only possible with the high-quality, contextualized intelligence provided by Phoenix Blue.

The talk emphasizes that this entire framework is designed to operate at the speed of AI, processing new intelligence and making decisions in minutes, rather than the 28-day lag often seen with NVD updates (36:00, 42:00).

Demo / Proof of Concept

▶ Watch: Phoenix Blue's scoring: Eliminating 'paper tigers' vs. 'tier one' (30:00)

While Francesco Cipollone's presentation did not include a live, interactive demonstration of the Phoenix Blue platform, he extensively detailed its capabilities and announced its immediate availability as an open-source solution. The platform itself, with its robust data processing, AI-driven analysis, and comprehensive scoring systems, serves as the practical proof of concept for the methodologies discussed.

Cipollone invited attendees to register for access to Phoenix Blue via phoenixintel.security (46:00), indicating that the system is fully operational and ready for use by the community. He explicitly stated that he would be approving credentials immediately after the talk (50:00). This open-source release is a deliberate move to empower all defenders with high-quality data and foster a collaborative coalition to fight AI with AI, bringing the detailed technical architecture and scoring mechanisms outlined in the talk into practical application for security teams worldwide.

Defensive Implications

▶ Watch: Q&A: EPSS accuracy with AI-driven exploitation (47:40)

The insights presented by Francesco Cipollone offer crucial defensive implications for organizations struggling with modern vulnerability management:

1. Shift to Proactive DevSecOps and Prevention: The sheer volume and velocity of AI-generated code and exploits necessitate a fundamental shift from reactive vulnerability management to proactive prevention. Defenders must push security "even before a specification level, before the code get generated" (24:00). Implementing robust DevSecOps practices is essential to block vulnerabilities from entering the pipeline altogether, rather than attempting to triage half a million lines of AI-generated code monthly (23:00).

1. Empower Defenders with AI, Don't Replace Them: AI is a powerful tool to "10x your capability" (02:00), but it should not replace human intelligence or decision-making. The "Human First, AI Second" manifesto (45:00) underscores that AI provides the intelligence, but humans define the methods, context, and ultimate decisions. Security teams must learn to effectively leverage AI to accelerate their work, not to abdicate their responsibilities (12:00).

1. Prioritize Context and Reachability over Raw CVSS: Traditional CVSS scores are insufficient for effective prioritization. Defenders must adopt a framework that answers four critical questions: who owns the asset, where the vulnerability truly resides, if it's reachable in the production environment, and what remediation actions are most effective (14:00-16:00). This contextual understanding allows security teams to focus on "critical vulnerability in system that are running, that are active, and are in production" (17:00).

1. Implement Real-Time, Data-Driven Threat Intelligence: Relying solely on the NVD or outdated intelligence is no longer viable. Organizations need real-time threat intelligence systems that can process millions of advisories hourly and react in minutes, not the 28 days it can take for NVD updates (36:00, 42:00). Phoenix Blue provides this capability, offering a blend of predictive analysis (like EPSS) and reactive intelligence to identify and prioritize truly exploitable threats (30:00, 48:00).

1. Fortify the Software Supply Chain Against Package Malware: The fragility of package management ecosystems demands dedicated defensive strategies. Organizations must implement OSS Metric Scoring Systems and "firewall" mechanisms to analyze and block malicious packages from entering their CI/CD pipelines (38:00-39:00). This is critical because many package-related vulnerabilities, such as Axios and TeamPCP, often do not appear in the NVD (38:00).

1. Leverage AI for Automated Remediation: The ultimate goal of intelligent prioritization is to enable rapid remediation. AI and LLMs can be utilized for "one-shot" automated fixes, capable of remediating entire libraries and conducting regression testing (44:00). This significantly reduces the manual effort and time required for patching, allowing security teams to address high-priority issues with unprecedented speed.

1. Foster Collaboration and Data Sharing: Cipollone's open-source release of Phoenix Blue and his call for collaboration with organizations like Valerian, VulnCheck, and Bugcrowd emphasize the need for a collective defense (46:00). Sharing high-quality data and intelligence across the community strengthens the overall security posture against a common, rapidly evolving adversary.

Key Takeaways

• The vulnerability landscape is experiencing unprecedented growth (300,000+ per year, 25% annual acceleration) and speed of exploitation (minutes to hours), rendering traditional vulnerability management obsolete.
• AI is a double-edged sword: it accelerates both offensive capabilities (code generation, exploitation, fake advisories) and offers powerful tools for defenders (intelligent analysis, prioritization, and remediation).
• Effective vulnerability management requires moving beyond raw CVSS scores to a data-driven approach focused on context, attribution, and reachability – understanding who owns the asset, where the vulnerability truly lies, and if it's exploitable in a running production environment.
• Phoenix Blue, an open-source threat intelligence platform, provides real-time, AI-driven intelligence by processing millions of advisories hourly, re-indexing NVD with CWE/CAPEC/TTP, and employing sophisticated LLM-based scoring to differentiate critical threats from "paper tigers."
• Securing the software supply chain is paramount. Dedicated OSS Metric Scoring Systems are needed to combat package-based malware and late-stage exploitation tactics that often bypass traditional CVE reporting and NVD.
• The "Human First, AI Second" philosophy emphasizes using AI to augment human decision-making and capabilities, enabling faster, more intelligent defensive actions, including automated "one-shot" remediation.

About the Speaker(s)

Francesco Cipollone is the founder and CEO of Phoenix Security, a company dedicated to revolutionizing vulnerability management. With approximately 15 years of extensive experience in vulnerability management, application security, and cloud security, Cipollone has a deep understanding of the challenges facing modern organizations. He previously served as the Head of Application and Cloud Security for a major organization, where he personally confronted the daunting task of managing 40 million critical vulnerabilities during a large-scale transformation (01:00, 06:00). This experience, which led to personal burnout, was a key motivator in his decision to create Phoenix Security. His company's mission is to empower businesses to understand and address their security posture effectively, shifting the conversation from overwhelming vulnerability counts to actionable, prioritized remedies (06:00).