Product security and vulnerability management have become critical components of an organization's overall cybersecurity strategy. However, these two teams often face challenges in working together effectively, leading to misalignment and potential security gaps. Patrick Garrity hosted a roundtable discussion with industry experts Matthew Clapham and Scott Kuffer to share applied lessons from product security teams and vulnerability management.

Patrick Garrity, Security Researcher at Nucleus Security, discusses the rise of vulnerabilities exploitation and threat intelligence in the field of vulnerability management. He highlights the history of vulnerability management, the increase in vulnerabilities and exploitation, the limitations of the common vulnerability scoring system (CVSS), and the emergence of vulnerability threat intelligence. Patrick also emphasizes the importance of open-source intelligence, such as CISA's Known Exploited Vulnerabilities (KEV) List and the Exploit Prediction Scoring System (EPSS), as well as the value of commercial threat intelligence.

Patrick Garrity, Security Researcher at Nucleus Security, interviews Aleksandr Yompolski, CEO of Security Scorecard, about the evolving cybersecurity landscape and the role of security ratings and risk assessments. They discuss the challenges organizations face in defending against exploitation attacks, the need for collaboration and communication in the industry, and the importance of balancing security and business agility.

When you’re managing cybersecurity at the enterprise level, it’s crucial to have a full breadth of understanding of the ins-and-outs of your enterprise vulnerability management program — including all of the challenges that come along with it. Only then can you begin to effectively prioritize risks and get ahead of vulnerabilities as quickly as possible. In this webinar, join our panelists of cybersecurity experts as they discuss.

This past week, Patrick Garrity, Security Researcher at Nucleus, spent a lot of time exploring Cybersecurity and Infrastructure Security Agency's update the Known Exploited Vulnerabilities catalog, which now includes attribution to vulnerabilities associated with ransomware campaigns. In this short video, he explores this new addition and walks through the data visualizations he created to provide broader visibility into this new addition.