Patrick Garrity 👾🛹💙

Featured image

State of Exploitation - A Peek into 1H-2024 Vulnerability Exploitation
VulnCheck’s Patrick Garrity analyzes vulnerability exploitation trends in the first half of 2024, including:

VulnCheck identified 390 newly exploited vulnerabilities (235 software suppliers across 310 products and services) compared to CISA KEV's 73.

The top 5 product categories with exploited vulnerabilities were network edge devices, CMS’s, open source software, server software, and operating… Show more

State of Exploitation - A Peek into 1H-2024 Vulnerability Exploitation
VulnCheck’s Patrick Garrity analyzes vulnerability exploitation trends in the first half of 2024, including:

VulnCheck identified 390 newly exploited vulnerabilities (235 software suppliers across 310 products and services) compared to CISA KEV's 73.

The top 5 product categories with exploited vulnerabilities were network edge devices, CMS’s, open source software, server software, and operating systems.

Of the 390 vulnerabilities, 53 were zero-days, 92 were newly weaponized, and 70% had PoCs available before exploitation disclosure. Show less

Key DBIR Takeaways. Verizon Business releases its highly-anticipated Data Breach Investigations Report around this time of the year (although this year felt really early) so that we can pore over the 100 pages of charts and insights.

In this episode they discuss the importance of integrating threat intelligence into vulnerability management using the Exploit Prediction Scoring System (EPSS), CISA Known Exploited Vulnerabilities Catalog, and the changes in CVSS 4.0!

Here are some highlights from the episode:

- How Exploit Prediction Scoring System (EPSS) can predict exploitation
- How vulnerability scanners integrate EPSS
- CISA's Known Exploited Vulnerabilities (KEV) Catalog
- The national security… Show more

In this episode they discuss the importance of integrating threat intelligence into vulnerability management using the Exploit Prediction Scoring System (EPSS), CISA Known Exploited Vulnerabilities Catalog, and the changes in CVSS 4.0!

Here are some highlights from the episode:

- How Exploit Prediction Scoring System (EPSS) can predict exploitation
- How vulnerability scanners integrate EPSS
- CISA's Known Exploited Vulnerabilities (KEV) Catalog
- The national security implications of vulnerability management Show less

Welcome to The Unhinged RSDA Survival Guide: Vendor Edition!

I didn’t know whether to laugh or cry when I saw the NVD’s most recent announcement (last week) about…what is this about, anyway? Here is what it said:

Data Visualizations and Insights from Patrick Garrity are included within the Book.

NVD paralysis: It has now been officially two months since the NIST NVD stopped enriching CVEs with additional metadata and details, and we still don't know what exactly happened. According to VulnCheck's Patrick Garrity, the infosec community isn't waiting for NIST to get its business in order, and unprocessed CVEs are piling up more each day.

Voices in the vulnerability management community warned that the lasting issues of the US National Vulnerability Database (NVD) could lead to a major supply chain security crisis.

A group of 50 cybersecurity professionals signed an open letter that was sent on April 12 to the US Secretary of Commerce, Gina Raimondo, and several members of the US Congress.

NVD checked out, then they came back? Maybe?

Should the xz backdoor be treated as a vulnerability?

Is scan-driven vulnerability management obsolete when it comes to alerting on emerging threats?

What were some of the takeaways from the first-ever VulnCon?

EPSS is featured in over 100 security products, but is it properly supported by those that benefit from it?

How long do defenders have from the moment a vulnerability is disclosed to patch or mitigate it… Show more

NVD checked out, then they came back? Maybe?

Should the xz backdoor be treated as a vulnerability?

Is scan-driven vulnerability management obsolete when it comes to alerting on emerging threats?

What were some of the takeaways from the first-ever VulnCon?

EPSS is featured in over 100 security products, but is it properly supported by those that benefit from it?

How long do defenders have from the moment a vulnerability is disclosed to patch or mitigate it before working exploits are ready and in the wild?

There's SO much going on in the vulnerability management space, but we'll try to get to the bottom of some of in in this episode. In this interview, we talk to Patrick Garrity about the messy state of vulnerability management and how to get it back on the rails. Show less

VulnCheck leaders share insights on navigating the challenges of vulnerability management at scale through automation, data sharing, and collaboration.

Vital data used to protect against cyberattacks is missing from more than 2,000 of the latest entries in the world’s most widely used vulnerability database.

Early exploitation reporting: According to a recent VulnCheck infographic, CISA, the Shadowserver Foundation, and Google's Project Zero team have been the top three sources of active exploitation over the past two decades.

Patching remains one of the most difficult security tasks organizations face. Zero-day vulnerabilities may catch the headlines, but the truth is most organizations are caught out by n-day vulnerabilities where patches have been available for some time. The U.S. Cybersecurity and Infrastructure Security Agency has tried to simplify patching efforts by publishing the Known Exploited Vulnerabilities list, or KEV. The KEV is a list of vulnerabilities under active exploitation, and federal agencies… Show more

Patching remains one of the most difficult security tasks organizations face. Zero-day vulnerabilities may catch the headlines, but the truth is most organizations are caught out by n-day vulnerabilities where patches have been available for some time. The U.S. Cybersecurity and Infrastructure Security Agency has tried to simplify patching efforts by publishing the Known Exploited Vulnerabilities list, or KEV. The KEV is a list of vulnerabilities under active exploitation, and federal agencies have two weeks to patch ones on the list. In this edition of Studio 471, Patrick Garrity of Nucleus Security shares the effects of the KEV list across the security industry, his research into the KEV and how threat intelligence can guide patching efforts. Show less

The latest vulnerability severity scoring system addresses gaps in the previous version; here's how to get the most out of it.

In this Risky Business News sponsor interview, Catalin Cimpanu talks with Patrick Garrity, VP of Marketing and security researcher at Nucleus Security, on the rise and evolution of vulnerability threat intel and how CISA KEV’s new ransomware section will be a game changer.

Let's explore an alternative approach, the Exploit Prediction Scoring System (ESS). EPSS represents a data-driven initiative to estimate the likelihood of a software vulnerability being exploited in real-world scenarios.

Chris Hughes Article Featuring Patrick Garrity's data visualization.

Chris Hughes article featuring Patrick's visualization on the changes from CVSS 3.1 to CVSS 4.0 Image Used in Chris Hughes Article.

Patrick's interactive data visualization featured in vulnerability and security reseaarch coverage.