The Vulnpocalypse - Good News and Bad News

tl;dr

• The bad news is we are inundated with new vulnerabilities due to the increased volumes discovered by AI tooling.

• The good news is many organizations are starting to handle this with increased speed, prioritization, and existing methods of defense in depth.

• The bad news is there are also many organizations not doing this, and worse, are sitting on a whole ton of software, configuration, and structural/policy vulnerabilities from prior years.

• The good news is many of these targets have not been exploited due to attacker’s resource constraints.

• The bad news is that this might not hold as attackers industrialize their capabilities to turn more targets of opportunity into actual victims.

• The good news is, apart from scams, crypto/Web3, and some parts of the ransomware kill chain, it appears that such industrialization is not helping monetization (yet).

• The bad news is attackers are an innovative bunch and not likely to give up and go set up a bakery, or go back to drug dealing. Besides, chaos may still ensue as agent swarms simply exploit vulnerabilities anyway.

• The good news is defenders can use all this AI capability for defense. We are seeing the potential that many significant code bases will have dramatically lower vulnerabilities levels than ever before due to the “deep cleaning” (h/t Heather Adkins) with the very same tools we are concerned attackers will use.

• The bad news is getting a code base “clean” doesn’t mean the updated packaged software will arrive quickly in all the places where attacks will target.

• The good news is……..?

Bottom line: Remediating vulnerabilities is more than finding and fixing the vulnerability in a code base. That’s becoming the “easy” bit. The hard bit for the vast majority of enterprises is actually getting the update actually deployed to the places that will face the exposure. This requires many adjustments in both compensating controls but also in ways we can manage the reliability risks of updates so we can move quicker (move fast but don’t break things). We’re coming to a world where vulnerability management transitions to end to end vulnerability operations.