
News Summary:
A record-breaking 20,130 software vulnerabilities were reported in 2021 - 55 a day on average. However, only 4% of them pose a high risk to organizations.
An organization can greatly reduce its chance of breach, or exploitability score, by up to 29 times by first fixing high-risk vulnerabilities with public exploit code and having a high remediation capacity.
Using Twitter mentions to prioritize software fixes is twice as effective at reducing exploitation as the industry-standard Common Vulnerability Scoring System (CVSS).
SAN JOSE, Calif., Jan. 19, 2021 - New research has quantified the success of various strategies for vulnerability management and the exploitability of entire organizations, expanding the risk-based playbook for cybersecurity practices.
With an average of 55 new software vulnerabilities published every day in 2021, even the best staffed and resourced IT teams cannot fix all of the vulnerabilities across their infrastructures. Fortunately, there is a better solution.
The research conducted by, Kenna Security, now part of Cisco and a market-leader in risk-based vulnerability management, and the Cyentia Institute, shows that properly prioritizing vulnerabilities to fix is more effective than increasing an organizations' capacity to patch them, but having both can achieve a 29 times reduction in an organizations' measured exploitability.
The findings are explained in Kenna's latest report, Prioritization to Prediction, Volume 8: Measuring and Minimizing Exploitability.
Exploitations in the wild used to be the best indicator for which vulnerabilities security teams should prioritize. Now we can show the likelihood of a particular organization being exploited, which is what we've always wanted to do, said Ed Bellis, co-founder and chief technology officer of Kenna Security, now part of Cisco. This gives organizations a much better chance at combating potential cyber threats effectively and the research shows that our customers are successfully managing their vulnerability risk every day.
Exploitability was determined using the open Exploit Prediction Scoring System (EPSS); a cross-industry effort including Kenna Security and the Cyentia Institute that is maintained by FIRST.org.
The research confirms a recent Cybersecurity and Infrastructure Security Agency (CISA) directive that suggests it's wiser to move away from prioritizing fixing of vulnerabilities based on CVSS scores and instead focus on high-risk vulnerabilities. Analysis shows that factors like exploit code and even Twitter mentions are better signals than CVSS scores.
Its clear that a shift to exploitability is going to make a huge difference based on the data and findings in this report. An analysis of CISAs published vulnerabilities suggests that they may also be moving course away from CVSS scores as we were conducting this research, said Wade Baker, partner and co-founder of Cyentia Institute. We took it a step further to account for remediation velocity when making our calculations, which should better inform security teams.
The research also suggests that:
Nearly all (95%) IT assets have at least one highly exploitable vulnerability.
Prioritizing vulnerabilities with exploit code is 11 times more effective than CVSS in minimizing exploitability.
Most (87%) organizations have open vulnerabilities in at least a quarter of their active assets, and 41% of them show vulnerabilities in three of every four assets.
A strong 62% majority of vulnerabilities have less than a 1% chance of exploitation. Only 5% of CVEs exceed 10% probability.
Additional Resources
Read the full report, Prioritization to Prediction, Volume 8: Measuring and Minimizing Exploitability, the latest installment of Kenna Security's series
Read the blog
Engage with Kenna on Twitter, Facebook, and LinkedIn.
About Cisco
Cisco (NASDAQ: CSCO) is the worldwide leader in technology that powers the Internet. Cisco inspires new possibilities by reimagining your applications, securing your data, transforming your infrastructure, and empowering your teams for a global and inclusive future. Discover more on The Network and follow us on Twitter.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. A listing of Ciscos trademarks can be found at www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company.
Most recent headlines
06/10/2025
France T l visions, France's leading broadcaster, has received the 2025 EBU ...
04/09/2025
Monumental Sports & Entertainment (MSE), in collaboration with Dalet, has been a...
15/06/2025
July 2025 in Dublin, Berlin, Amsterdam & London
Photo: Thea Martre
Music Production for Women (MPW) have announced that they will be running a series of fo...
15/06/2025
Composer/producer launches free virtual instruments
Sulcata Sound is the latest venture of Jason Graves, a two-time British Academy Award-winnning composer,...
14/06/2025
NEW YORK Pluto TV and the All Womens Sports Network have launched a free ad-supported streaming TV (FAST) AWSN channel in the U.S., Canada, the U.K. and the Nor...
14/06/2025
NEW YORK and CINCINNATI E.W. Scripps has announced a new, multiyear agreement with the WNBA that will continue Ions regular-season coverage of the league on Fri...
14/06/2025
WASHINGTON The National Association of Broadcasters highlighted the hidden importance of spectrum in the production of major sporting events and described wha...
14/06/2025
WASHINGTON Sunsetting ATSC 1.0, expanding business opportunities for NextGen Broadcast and increasing international adoption of the ATSC 3.0 standard were top o...
14/06/2025
SAN FRANCISCO Samba TV and Acxiom have announced that they will dramatically expand their longstanding relationship....
14/06/2025
July 2025 in Dublin, Berlin, Amsterdam & London
Photo: Thea Martre
Music Production for Women (MPW) have announced that they will be running a series of fo...
14/06/2025
San Francisco State University's School of Cinema Uses Blackmagic Design
Brie Clayton June 13, 2025
0 Comments
More than 40 Blackmagic Design came...
14/06/2025
Boris FX Mocha Pro Adds New AI Tools To Tackle VFX Tasks Fast
Jessie Electa Petrov June 13, 2025
0 Comments
The 2025.5 release helps artists work more...
14/06/2025
AJA Debuts DRM2-Plus Mini-Converter Frame at InfoComm 2025
Brie Clayton June 13, 2025
0 Comments
Next-gen frame addresses diverse rackmount needs wit...
13/06/2025
(L-R) Lindsay Utz, Michelle Walshe, and The Right Honourable Dame Jacinda Ardern attend the 2025 Sundance Film Festival premiere of Prime Minister at Eccles T...
13/06/2025
Photo credit: Atsushi Nishijima
If you're a true lover of rom-coms, chances...
13/06/2025
Pure Drama and Fierce Rivalries set to dominate the world's most iconic spor...
13/06/2025
Johannesburg, 12 June 2025 - The National Film and Video Foundation (NFVF), an a...
13/06/2025
ABILENE. Texas A severe storm knocked down the tower and severely damaged the news studio and main facility of Sinclair-owned KTXS here on Sunday, June 8....
13/06/2025
Berklee's Music Business/Management Department Recognized by the Music Biz A...
13/06/2025
WASHINGTON The ATSC, the Broadcast Standards Association, honored veteran technologist Aldo Cugnini and Clarence Hau, Senior Vice President of Standards, Policy...
13/06/2025
(Editor's note: The 2025 UFL Championship Game between the D.C. Defenders and Michigan Panthers kicks off Saturday, June 14, at 8 p.m. Eastern. The game wil...
13/06/2025
New iPad/iPhone synth App announced
Following on from last year's release of Gradient Synth - which reached #6 on the App Store's Paid Music charts ...
13/06/2025
LONDON Warner Bros. Discovery has announced that HBO Max will launch direct-to-consumer in multiple new countries this July as the streamer becomes available in...
13/06/2025
AI voice transcription and captioning platform Verbit has added a new feature to its Captivate ASR solution the ability to identify specific features in automat...
13/06/2025
WASHINGTON Federal Communications Commission member Anna Gomez has wrapped up two weeks in California visiting broadcasters, television studio executives, enter...
13/06/2025
WASHINGTON The U.S. House of Representatives voted mostly along party lines to approve a rescission package that would cancel $9.4 billion in previously approve...
13/06/2025
At InfoComm 2025, AJA Video Systems announced DRM2-Plus, an intuitive, high-capacity 3RU frame that can neatly house up to 24 AJA Mini-Converters. Tailored to s...
13/06/2025
Cinema advertising leader to leverage AOS and suite of AI-enabled solutions to optimize forecasting, yield management, and streamlined ad sales and operations a...
13/06/2025
Manfrotto has launched the ONE Hybrid Tripod, a new support system designed specifically for professional content creators working with mirrorless cameras acros...
13/06/2025
Leading video software provider, Synamedia, today announced that its Media Edge Gateway (MEG), an ATSC 3.0 software-based IRD, now supports Device Security requ...
13/06/2025
LiveU, the global leader in live IP-video contribution, production and distribution solutions, is deepening its commitment to the German-speaking market with th...
13/06/2025
Chaos, the leader in architectural visualisation software, today announces Chaos Corona 13, giving archviz designers new ways to add eye-catching style and flai...
13/06/2025
PALI's Nena Music Video Shot with Blackmagic Design
Brie Clayton June 12, 2025
0 Comments
Blackmagic Cinema Camera 6K and DaVinci Resolve Studio b...
13/06/2025
OddBeast Powers Up iRobot's Newest Roombas with Suite of CGI Launch Assets
Brie Clayton June 12, 2025
0 Comments
The motion design and production ...
13/06/2025
On Chick Coreas Birthday, a Newly Uncovered Archival Release The Visitors, composed by Corea and performed by vibraphonist Gary Burton and pianist Kirill Gers...
13/06/2025
In fulfilment of a recommendation by the Government's Expert Advisory Commit...
13/06/2025
SVG Sit-Down: Backblaze's Gleb Budman Talks Products, Partnerships, and the ...
13/06/2025
SVG Sit-Down: DAZN's Walker Jacobs Calls Streaming the FIFA Club World Cup ...
13/06/2025
New Sponsor Spotlight: Vecima Networks' Paul Strickland on How Improving QoE...
13/06/2025
Pitch Perspective: Where's Next for Specialty Cameras in Soccer? Leaders from Sky Austria and ACS discuss the possibilities of camera placement pitchside B...
13/06/2025
Premiership Rugby Final 2025: Vintage clash between Bath and Leicester gets full...
13/06/2025
Premiership Rugby Final 2025: TNT Sports gears up for Bath vs Leicester battle w...
13/06/2025
NCAA Men's College World Series: ESPN Adds Two-Point SupraCam, Invests in Ne...
13/06/2025
New FSWX signal and spectrum analyzer with novel architecture overcomes limits o...
13/06/2025
Apple today announced the addition of iPad to Self Service Repair, providing iPad owners with access to repair manuals, genuine Apple parts, Apple Diagnostics t...
13/06/2025
CUPERTINO, CALIFORNIA Apple today previewed iOS 26, a major update that brings a beautiful new design, intelligent experiences, and improvements to the apps use...
13/06/2025
At Apple's Worldwide Developers Conference (WWDC), Apple unveiled Apple Games, an all-new destination designed to help players jump back into the games they...
13/06/2025
Industrial AI isn't slowing down. Germany is ready.
Following London Tech Week and GTC Paris at VivaTech, NVIDIA founder and CEO Jensen Huang's Europea...
12/06/2025
In 2018, Spotify launched Heart & Soul, a mental health initiative developed to ...
12/06/2025
50 Years Strong: SBS and NITV Supercharge NAIDOC Week 2025 in a joint 50th celeb...