Adding two kinds of statistics to Vulnerability-lookup to help VulnOps team to (regularly) adapt their vulnerability management policies, processes and workforce based on factual data.
- Knowing how many CVEs (as a %age) don’t have SSVC data filled by the CISA Coordinator.
This would help teams to understand potential blind spots when following CISA BOD 26-04 for their patch management policy and evaluate the need to develop proxies for automatable and Technical Impact fields - Approximating how many CVEs would require emergency (72h) mitigation over a 1-year period according to CISA BOD 26-04 directive based on SSVC. Ideally a dynamic view where CPEs could be selected by the organization to define its ‘exposed perimeter’ and a default view (several ideas to be discussed here: top 100 of the most commonly exploited products, top 100 of what we can consider as exposed systems (e.g. VPN gateways, reverse proxies, untrusted content processing systems such as antimalware, email gateways and clients, document processing software, etc., commonly exposed web servers and middleware, etc.))
I agree this may not be directly related to the initial objectives of Vulnerability lookup but following a discussion during the hackathon, I understand that all the data are available in the vulnerability lookup to compute such statistics.