Vulnerability Intelligence.

How does vulnerability intelligence work?

A scanner tells you which weaknesses exist. Vulnerability intelligence adds outside context to each one. Common inputs are public records of weaknesses such as the NIST National Vulnerability Database, severity scores, lists of weaknesses known to be exploited, and estimates of how likely exploitation is. Each is a different signal, and none is enough alone.

• CVE gives a weakness a public identifier.
• CVSS scores how severe a weakness is. FIRST states that CVSS measures severity, not risk (see the CVSS v4.0 user guide).
• The CISA Known Exploited Vulnerabilities catalog lists weaknesses with evidence of exploitation in the wild.
• EPSS from FIRST estimates the probability that a weakness will be exploited in the wild.

Why does it matter?

Teams cannot fix everything at once. If you sort only by severity score, you may spend time on weaknesses nobody uses and miss one that attackers already exploit. Intelligence helps you choose. CISA asks organizations to use its catalog as an input to their vulnerability management prioritization.

How do you use it?

• List the systems you run, including those facing the internet.
• Match new weaknesses against that list, so you only look at what applies to you.
• Raise the priority of anything reported as exploited or likely to be.
• Track what was fixed and what was accepted as a risk.

Brandefense Cyber Threat Intelligence brings this context together. See the use case vulnerability intelligence for more.

Related pages in the Knowledge Hub

• Threat Intelligence Platforms 101
• Threat Intelligence 101
• Vulnerability management
• Vulnerability intelligence use case
• What is Vulnerability Intelligence?