Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces a Bayesian framework for quantifying local exploit hazards, transforming global exploit probabilities from models like the Exploit Prediction Scoring System into daily hazard rates tailored to an organization's assets. By leveraging expert opinions and updating them through Beta-Binomial inference from real-world data, the model assesses the effectiveness of existing security controls and provides a probabilistic basis for prioritizing remediation actions. The approach not only aggregates per-vulnerability exploitation likelihoods into comprehensive hazard rates but also incorporates survival-analysis techniques to model the decay of exploitation risk over time, enabling organizations to make informed decisions on risk management.
Local exploit hazard rates can now be quantified with a Bayesian approach, offering organizations a data-driven method to prioritize security measures effectively.
This paper presents a local exploit hazard model : a Bayesian framework that converts the global probabilities produced by an exploit likelihood model (ELM), such as the Exploit Prediction Scoring System (EPSS), into a daily exploit hazard rate for an organization's own assets. The model measures the exploit-prevention effectiveness of deployed controls as a probability distribution. That distribution is seeded from a subject-matter-expert opinion pool and updated through Beta-Binomial inference from telemetry, breach-and-attack simulation, or penetration testing, then applied to ELM scores by attack-vector alignment. The resulting per-vulnerability exploitation likelihoods are converted into hazard rates using standard survival-analysis techniques, supporting both a constant exponential hazard and a Weibull hazard whose shape parameter, calibrated from Known Exploited Vulnerabilities catalog timing, captures the empirical decay of exploitation risk as a vulnerability ages. Because hazards are additive under independence, per-vulnerability rates aggregate by summation up to host, network, business unit, and organization. Candidate remediation actions are simulated and ranked by projected hazard reduction, giving defenders a defensible, quantitative basis for prioritization under fixed capacity. Future work includes extensions for incident likelihood and financial loss modeling.