Vulnerability Threat Intelligence

The critical role of contextual vulnerability threat intelligence 

In the world of cybersecurity, the number of known software vulnerabilities continues to rise each year, and exploited vulnerabilities are rapidly becoming the most common attack vector for cybercriminals. Threat actors have a wealth to choose from, while security teams work frantically to patch known vulnerabilities before attackers can exploit them. Because it’s impossible to remediate every vulnerability, security teams must manage risk by treating the most dangerous ones first.

That’s where Cybersixgill can help – with contextual vulnerability threat intelligence gleaned from monitoring the clear, deep and dark web. Our Dynamic Vulnerability Intelligence provides an end-to-end solution spanning the entire CVE lifecycle, streamlining vulnerability analysis, management and remediation/mitigation by equipping teams with the critical, context-rich threat intelligence they need to identify and prioritize vulnerabilities that pose the greatest risks to the organization - before they can be exploited in attack. 

What is contextual vulnerability threat intelligence?

As the number of software volatilities continues to grow, security teams are tasked with the difficult challenge of vulnerability prioritization. Theoretically, by patching the most dangerous vulnerabilities first, security teams can effectively reduce risk and improve their organization’s security posture.

In practice, however, determining which vulnerabilities represent the greatest risk is a complicated endeavor. The traditional approach to evaluating risk –the Common Vulnerability Scoring System, or CVSS – measures the severity of the impact on an organization if a particular vulnerability were to be exploited. But of the hundreds of thousands of known vulnerabilities, only a small percentage - 6% - are likely to be used by attackers. When using CVSS ratings alone, security teams may spend a great deal of time patching high-severity vulnerabilities that have zero chance of being exploited, while failing to patch other vulnerabilities that are favored by attackers, simply because they have lower CVSS scores.

What security teams really need is contextual vulnerability threat intelligence that reveals what vulnerabilities are most likely to be exploited soon, along with critical context around each vulnerability. For example, security teams can benefit from knowing which threat actors are interested in certain vulnerabilities and what their objectives may be. It’s also helpful to know how easily a vulnerability can be exploited, and what kind of proof-of-concept or exploit code has already been written and shared between attackers. Knowing how exploited vulnerabilities may be combined with other attack vectors in a complex campaign is invaluable.

The cybercriminal underground – the deep and dark web - is the best source of information. By monitoring underground forums and marketplaces, code repositories and paste sites, and other channels where malicious threat actors gather online, security teams can better understand emerging threats – and what they must do to combat them.

Cybersixgill: automated contextual vulnerability threat intelligence 

Cybersixgill was founded with a single purpose: to equip organizations with the insights they need to effectively protect their systems against malicious cyber threats before they materialize. Our fully automated cyber threat intelligence solutions covertly extract data from a wide range of sources on the clear, deep and dark web. From invite-only messaging groups and limited-access dark web forums to code repositories and social media on the clear web, we extract data 24x faster than our competitors to deliver superior contextual vulnerability intelligence for our customers.

DVE refines vulnerability assessment, management and prioritization processes by correlating asset exposure and impact severity data with real-time, contextual vulnerability intelligence derived from cybercriminal activity and discourse across the deep, dark and clear web. Using advanced AI models, DVE harnesses these insights to generate a robust, accurate and transparent prediction of exploitation probability over the next 90 days, mere hours after the CVE is first published. Continuously updated in real-time, each risk-score is backed with full visibility into the complete body of collected vulnerability intelligence linked to each CVE, including dynamic attributes such as where it is trending, associated ransomware and APT groups, POC and exploit kit details, related underground chatter, actor and source reputation, and more. 

DVE’s advanced features and functionalities support all stages of the CVE lifecycle - from advanced CPE-CVE matching and MITRE technique mapping capabilities to the provision of vulnerability and exploit intelligence and remediation information - dramatically accelerating the efficiency and productivity of security and vulnerability teams. DVE aggregates CPE data from multiple sources to fix the data deficiencies in the NVD’s CPE dictionary, automating the CPE to CVE matching process with high-fidelity data to deliver the most accurate results. This best-in-class CPE attribution information is then correlated with each organization’s defined assets, triggering automated alerts to warn teams of the specific vulnerabilities that directly expose their systems to attack, just hours after the CVE is first published.

Benefits of DVE Intelligence

Cybersixgill’s Vulnerability Intelligence provides clear advantages for security teams.

• Gain contextual vulnerability intelligence in real-time. DVE Intelligence enriches each CVE with critical contextual insight regarding the discourse, potential impact, exploitability and urgency for each vulnerability before cybercriminals exploit them in an attack.

• Reduce false positives/negatives. DVE refines the risk assessment process with advanced precision, automatically mapping exposed vulnerabilities (CVEs) to specific products and versions (CPEs), allowing teams to focus only on those vulnerabilities that directly expose their existing IT assets and infrastructures to attack.  

• Identify high-risk vulnerabilities earlier. While a newly discovered vulnerability may not be assigned a CVSS score for days or weeks, Cybersixgill assigns a DVE score within hours, helping security teams to quickly prioritize remediation for high-risk CVEs affecting their networks.

• Streamline vulnerability management. DVE Intelligence supports all phases of the vulnerability exposure management lifecycle. By integrating easily with existing security technology and automating critical processes, Vulnerability Intelligence can accelerate the efficiency of security teams and streamline vulnerability management from end to end.

• Intelligence based on comprehensive sources. Cybersixgill has the broadest threat intelligence capabilities available in the industry, autonomously scraping data from sites that are often inaccessible to other vendors.

• Deeper insights into threat actor plans. DVE  harnesses Cybersixgill’s best-in-market vulnerability intelligence to provide unparalleled insight into the adversarial mindset, automatically mapping each vulnerability to adversary tactics and techniques as defined in the MITRE ATT&CK framework to align CVE assessments with existing security controls and defensive workflows.          

Why Cybersixgill? 

Cybersixgill represents a quantum leap into the next stage of evolution in threat intelligence collection. With collection capabilities that are 100% automated, Cybersixgill maximizes incident response, reduces false positives, minimizes human error and increases the productivity of security teams. With intelligence collected from more sources and extracted with greater speed than any other threat intelligence vendor, Cybersixgill helps organizations to quickly detect and remediate phishing attacks, data leaks, fraud, ransomware, vulnerability exploits and other cybercrime.

FAQs

What is a software vulnerability?

A software vulnerability is a flaw or weakness in the code of a software program that can be exploited by an attacker to gain access to the IT environment in which it’s running. Attackers target vulnerabilities in order to penetrate an organization’s defenses and to steal data or money or to disrupt or damage the business in some way.

What is vulnerability prioritization?

When vulnerabilities are discovered, they are fixed by applying a software update called a patch. Because there are too many vulnerabilities to fix at any one time, patching must be prioritized based on the danger that a vulnerability represents to the organization.

What is contextual vulnerability intelligence?

Contextual vulnerability threat intelligence provides security teams with an indication of which vulnerabilities represent the greatest risk. Superior contextual vulnerability intelligence is based on intelligence collected from the deep and dark web, where threat actors often reveal or leave clues to the vulnerabilities they are likely to exploits in the near future. Contextual vulnerability intelligence can help security teams to understand which vulnerabilities are easiest to target and how attackers might exploit them to gain access.