Traditional vulnerability assessment falls short on third-party risks

As organizations increasingly rely on third-party vendors, open-source components, and cloud services to bolster efficiency and scalability, they also open themselves to risks. Historically they've relied on CVSS scores to measure the severity of risks, but a new report from Black Kite suggests that this method alone is not enough. 'Focusing solely on Common Vulnerability Scoring System (CVSS) scores is insufficient for risk management,' says Ferhat Dikbiyik, chief research and intelligence officer at Black Kite. 'CVSS is not a prioritization tool and cannot inform security teams whether a vulnerability is being exploited or the likelihood it will be weaponized. Further… [Continue Reading]