Alexandre Dulaunoy
@adulau@infosec.exchange
Enjoy when humans are using machines in unexpected ways. I break stuff and I do stuff. The other side is at @a (photography, art and free software at large) #infosec #opensource #threatintelligence #fedi22 #threatintel #searchable
infosec.exchange
From a research paper to running open-source code in just a few days.
We (with @cedric@fosstodon.org) have been experimenting in Vulnerability-Lookup with the concept of Local Exploit Hazard, based on the recent research paper “Modeling Local Exploit Hazard — A Bayesian Framework for Quantifying Exploit Risk and Operational Efficiency” by Stephen Shaffer and Laura Cristiana Voicu.
The idea addresses an important question in vulnerability management:
Not simply “How dangerous is this vulnerability globally?” but “How much exploitation risk does this vulnerability represent in my environment?”
Instead of introducing yet another static vulnerability score, the model starts from exploit likelihood such as EPSS and combines it with local security controls, CVSS attack vectors, vulnerability age and KEV policy to estimate an exploitation hazard.
We implemented an experimental version in Vulnerability-Lookup and connected it directly to operational workflows.
For the full details: https://www.vulnerability-lookup.org/2026/08/11/local-exploit-hazard/
#cve #gcve #vulnerabilitymanagement #vulnerability #opensource #opendata
@circl@social.circl.lu
Python implementation 