The day a flaw goes public is no longer the day the race starts. Sean Martin of ITSP Magazine opens the Qualys Cyber Risk Series with the gap between exposure and detection. Follow Qualys on BrightTALK for more Cyber Risk Series talks: https://www.brighttalk.com/channel/11673 Explore the Qualys Enterprise TruRisk Platform: https://www.qualys.com/etm Build your Risk Operations Center (ROC) today: https://www.qualys.com/roc Sean Martin, journalist and technologist at ITSP Magazine, kicks off Mind the Gap: From Disclosure to Detection. Scanning every 90 days and fixing within 90 days used to hold up, because months passed between a flaw going public and an attacker using it. That clock has changed. This session is about the distance between something being out there and you being able to see it in your own environment. He covers what the CISA KEV catalog tells you and what it leaves out, and why exploitation is now the most common way attackers get a first foothold, at 31% of breaches in the Verizon 2026 DBIR, ahead of credential abuse. Of roughly 48,000 vulnerabilities disclosed last year, he says 357 were remotely exploitable, actively weaponized, and had working exploit code. He also looks at CISA's shift toward risk-based prioritization in BOD 26-04, and a July case where an SD-WAN orchestrator flaw was disclosed, patched, and added to the KEV on the same day. Speaker: Sean Martin, Journalist and Technologist, ITSP Magazine Chapters: 0:00 Intro: the 90-day scan cycle and why it held up 0:48 The clock everything hangs off 1:14 What the CISA KEV catalog does and does not tell you 2:09 What never reaches the catalog 3:03 Exploitation is now the top initial access vector 3:59 The urgent list is already small: 357 of 48,000 4:41 CISA moves toward exposure-first prioritization 5:48 When disclosure and exploitation land on the same day 6:37 Finding flaws is easy, fixing them is not: meet the speakers #CyberRiskSeries #VulnerabilityManagement #CISAKEV #Qualys

 80      0