Most vulnerability management programs fail not because of missing tools, but because they try to fix everything and end up fixing nothing that matters. The “fix all highs and criticals” approach sounds responsible until you realize that most CVEs scored CVSS 7+ will never be exploited by a real attacker. Walter Haydock, Founder and CEO of StackAware, spent his career in government (Capitol Hill and the Marine Corps) before moving into enterprise software and launching a company focused on quantitative vulnerability risk assessment. In this episode, he explains why EPSS is a better prioritization signal than CVSS, how SBOMs and VEX statements transform supply chain security, and why the biggest vulnerability management problems are cultural — not technical.
You can read the complete transcript of the episode here >
What does an ideal vulnerability management process look like?
The first requirement: have a process at all. A Ponemon report found that roughly half of organizations use an email-and-spreadsheet approach to vulnerability management. Walter outlines what the process should include:
- Regular patching and update cadences: If you can update software to remove a vulnerability, just do it. That is the easiest and cheapest remediation path. The challenge comes when updates require downtime or new product releases.
- Clearly defined thresholds and actions: Decide ahead of time what severity level triggers what response, within what timeline. Most situations are foreseeable — a process that handles them without requiring a meeting or a senior leader’s decision every time is the goal.
- Documented playbooks: One-off responses to individual problems do not scale. Playbooks for patching, for accepting risk, for escalating exceptions — all should exist before the vulnerability is discovered.
The anti-pattern: addressing every vulnerability ad hoc as it appears, requiring executive sign-off each time. That approach collapses under volume and trains leadership to ignore security requests. Good vulnerability management requires systematic processes, not heroics.
Why is EPSS better than CVSS for vulnerability prioritization?
Walter makes a strong case against CVSS-based prioritization and for EPSS (Exploit Prediction Scoring System):
- CVSS overloads remediation teams: Most CVEs in the National Vulnerability Database score CVSS 7 or higher. Telling engineering to “fix all highs and criticals” means fixing almost everything — which means fixing nothing in practice.
- EPSS is probability-based: It provides a score from 0 to 1 representing the probability of a vulnerability being exploited in the wild. Understanding EPSS is a fundamentally more actionable signal than a theoretical severity score.
- The efficiency gain is dramatic: Research shows that using EPSS for prioritization, organizations can target one-twelfth the number of vulnerabilities compared to CVSS-based approaches while achieving the same reduction in exploitable risk.
- Most CVEs are never exploited: Most known vulnerabilities are never exploited by a malicious actor in any realistic scenario. The ones that are get exploited quickly — often within hours of publication. Those are the ones that demand immediate action.
For organizations just starting out: use EPSS as the primary driver for remediation. As you mature, layer in asset value, business impact, and cost-of-remediation analysis to build a full quantitative risk picture — what separates basic vulnerability management from true risk management.
Where do organizations make the biggest vulnerability management mistakes?
Two fundamental errors:
- Trying to boil the ocean: Security teams mandate “fix all highs and criticals,” engineering receives 50,000 to 500,000 findings, and promptly ignores them all. The output of a boil-the-ocean approach is learned helplessness, not improved security.
- Lacking a consolidated asset inventory: You cannot fix vulnerabilities you do not know about. You cannot find vulnerabilities in assets you do not know exist. This includes SaaS platforms, cloud services, open source dependencies, and transitive dependencies.
The cultural dimension is equally important:
- Business leaders should own risk, not security teams. Security should illuminate and advise on risk. Business leaders — product managers, GMs, CIOs, CEOs — should make the risk decisions because they balance all organizational risks holistically: competitive, financial, regulatory, and security.
- Conditional thresholds beat universal mandates: “Internet-facing asset with EPSS above 0.7 must be fixed in one day” is actionable. “Fix all criticals within 30 days” is not, because it treats all criticals as equal when they are not.
Why do organizations need SBOMs and how should they use them?
Walter argues that most vulnerability management today is software supply chain security — whether it is open source libraries, proprietary vendor code, or SaaS platform dependencies.
- SBOMs depict complex supply chains in structured formats. Specifically, the CycloneDX format can show that a SaaS provider runs a specific open source library on top of AWS — enabling risk decisions about the full dependency chain.
- You must have a consumption plan before requesting SBOMs. Just like security questionnaires that nobody reads, SBOMs that nobody analyzes waste everyone’s time. Decide which vendors must provide them, how frequently, what format, and what actions you will take on findings.
- VEX statements eliminate unnecessary noise. Vulnerability Exploitability Exchange allows vendors to proactively state which CVEs in their components are not exploitable in their deployment context. This prevents the back-and-forth of “we found these CVEs in your SBOM” followed by “those are not reachable in our architecture.”
- Synthetic SBOMs fill gaps. When a vendor cannot or will not provide an SBOM, you can create your own structured depiction of their supply chain risk based on what you know — which cloud provider they use, which dependencies you can observe. It is not authoritative, but it is better than nothing.
The supply chain visibility that SCA tools provide at the code level, SBOMs extend to the organizational and vendor level — covering not just your direct dependencies but your supplier’s suppliers.
Can generative AI solve vulnerability management?
Walter is more direct than most: yes, AI will take some security jobs — specifically the repetitive, format-transfer, copy-paste type work. But it will not replace thinking.
- Where AI helps today: Asset classification from scanner output, converting unstructured vulnerability disclosures (blog posts) into structured VEX statements, reducing manual triage toil.
- Where it falls short: Generating security policies (too boilerplate, too vague), making risk decisions that require business context, and any task where the “why” matters more than the “what.”
- The career advice: If your job consists primarily of transferring information between formats or doing digital drudgery, you should be worried. If your job involves higher-level abstraction — asking why, making judgment calls, advising leadership — AI will make you more productive rather than replace you.
The key: understand what data you are feeding AI tools (never secrets or PII) and never take output at face value. Validate everything.
What are the key takeaways from the US National Cybersecurity Strategy?
Walter identifies three implications for security practitioners:
- Kinetic responses to cyberattacks are on the table. The US is signaling that a sufficiently severe cyberattack could trigger a military response. Business leaders should incorporate this geopolitical risk into their assessments.
- Liability is shifting to software manufacturers. Walter pushes back on this — arguing that another compliance framework may crown large incumbents who can absorb regulatory overhead while burdening smaller companies. He notes that FedRAMP actually penalizes organizations for finding too many vulnerabilities, which incentivizes not looking rather than looking and fixing.
- A national cyber insurance backstop is coming. If a catastrophic cyber event occurs, the government will likely step in to bail out insurance providers — similar to how FDIC works for banks.
