Fresh perspectives needed to manage growing vulnerabilities

In its inaugural 2023 Offensive Security Vision Report, NetSPI unveils findings that highlight vulnerability trends across applications, cloud, and networks.

Vulnerability patterns

The report offers a look back — and forward — at some of the most significant vulnerability patterns of the past year to help security and business leaders focus discovery, management, and remediation efforts on the riskiest vulnerabilities most likely to exist on their attack surface.

According to the NIST National Vulnerability Database vulnerability count has steadily increased year-over-year for the past five years – and shows no signs of slowing down. This, coupled with the reality of burnt-out security and development teams, creates an imminent need for prioritization.

The report analyzed over 300,000 anonymized findings from thousands of pentest engagements, spanning more than 240,000 hours of testing, to identify the most prevalent vulnerabilities across various industries — which include healthcare, retail, finance, and manufacturing.

Today, offensive security is only as valuable as its ability to help you prioritize remediation of the issues that matter most to your business.

Barriers to timely and effective remediation

Lack of resources, vulnerability prioritization, and business priorities were reported as the top three barriers to timely and effective remediation. The trend across all three? Security teams need support prioritizing the increasing number of vulnerabilities present in their environment.

Business and human context remains necessary to overcome vulnerability prioritization challenges, yet teams remain short staffed.

What researchers have found:

• On average, the highest volume of critical and high severity vulnerabilities were discovered within the government and nonprofit industry. On the contrary, insurance had the lowest volume of critical and high severity vulnerabilities.
• Internal networks have 3x more exploitable vulnerabilities than external networks.
• Of the applications tested, web applications have a higher prevalence of high and critical vulnerabilities compared to mobile and thick applications.
• The two greatest barriers to timely and effective remediation today are a lack of resources (70%) and prioritization (60%).
• 71% of respondents shared that less than one-fourth of security roles budgeted were entry-level, with 46% of those reporting no plans for entry-level hiring in 2023.

“One narrative made evident from our Offensive Security Vision Report is that vulnerability prioritization is critical,” said Vinay Anand, CPO at NetSPI.

“The reality is that we cannot fix every vulnerability discovered, but if prioritization and support continue to lack, the security industry will fall short. This realization, coupled with the industry experiencing rising burnout rates among developer teams, should evoke a sense of urgency. Our findings can help leaders grasp the severity of the situation to prioritize vulnerability management,” Anand continued.

“This report makes it abundantly clear that there’s still a lot to be done to support and enable the industry to improve vulnerability management,” said Cody Chamberlain, Head of Product at NetSPI.

“We hope the observations and actionable recommendations throughout our inaugural Offensive Security Vision Report are a great data-driven starting point for security teams to harden their security,” Chamberlain concluded.