Research
Our team (formerly of Kenna Security as well as co-creators of the EPSS) invented risk-based vulnerability management. But we believe there's areas of exposure management that haven't even been tapped, and they need to be explored urgently given the monumental challenges facing security teams. We're excited to publish our research (including ongoing benchmarks of our global and local models) and present them here.
Jay Jacobs, Chief Data Scientist
Michael Roytman, CTO
Dr. Benjamin Edwards, Head of Modeling
Jerry Gamblin, Head of Research
Reflections of a CAMLIS First-Timer
Reflections of a CAMLIS First-Timer
A couple weeks ago, I attended my first CAMLIS in Arlington, Virginia. The Conference on Applied Machine Learning in Information Security has been around since 2017, and its wordy but apt name explains itself as well as I could. Everyone was very friendly, and I had a lot of great conversations. The conference was well-run, and I thank the organizers for their hard work. Here, I’ll summarize my thoughts for those who couldn’t make it.
Naming without Knowing: On Being Vulnerable
Naming without Knowing: On Being Vulnerable
This is the second in a series about how we describe vulnerabilities and why it matters. Vulnerability records succeed at creating a shared name, but the data associated with that name are too coarse to reflect patterns of exploitation or defenders’ priorities. We have spent over 27 years now naming vulnerabilities without knowing exactly what they are.This series is about closing that gap.Naming without Knowing: On Being Vulnerable
November 2026 CVE of the Month: Which of Adobe's 31 ColdFusion Fixes to Rush (CVE-2026-106616)
November 2026 CVE of the Month: Which of Adobe's 31 ColdFusion Fixes to Rush (CVE-2026-106616)
“Wake me up when everything’s fixed”: the cost of AI remediation without prioritization
“Wake me up when everything’s fixed”: the cost of AI remediation without prioritization
AI can now write a patch for almost any vulnerability in minutes. That changes the equation of what AI can do for remediation, but it doesn’t change the question every security team has always faced: which fixes are worth making?
Hay and Needles
Hay and Needles
Vulnerability disclosures have more than tripled this year. The exploited ones have not kept pace, and they are easier to spot than the size of the pile suggests.
Naming without Knowing: An Introduction
Naming without Knowing: An Introduction
This is the first in a series about how we describe vulnerabilities and why it matters. Naming a vulnerability is not the same as knowing it. Vulnerability records succeed at creating a shared name, but the data associated with that name are too coarse to reflect patterns of exploitation or defenders’ priorities. This series is about closing that gap.
Kenna Is Sunsetting. Your Next Move Just Got Easier.
Kenna Is Sunsetting. Your Next Move Just Got Easier.
There's a smarter way forward than another traditional RBVM tool. And we know a thing or two about Kenna.
Microsoft Just Published More CVEs Today Than All of Last Year
Microsoft Just Published More CVEs Today Than All of Last Year
1,408 Microsoft CVEs in one Patch Tuesday, against 1,244 in all of 2025, in a year when the whole CVE count has doubled: what that does to a patch queue, and how Empirical helps you work it.
Nine Hours on a Train to VulnOptiCON
Nine Hours on a Train to VulnOptiCON
Three days of VulnOptiCON, two venues, one country smaller than Rhode Island, and the five things I would hand to anyone who patches for a living.
Reserved but Public: The CVE IDs That Exist Everywhere Except the CVE List
Reserved but Public: The CVE IDs That Exist Everywhere Except the CVE List
A public advisory, a shipped fix, in some cases an exploit, and no CVE Record. The CVE Program calls these IDs Reserved but Public. On October 5 there were at least 1,983 of them, and every tool that reads the CVE List sees none.
October 2026 CVE of the Month: The Next.js RCE Behind "Not Affected" (CVE-2026-75604)
October 2026 CVE of the Month: The Next.js RCE Behind "Not Affected" (CVE-2026-75604)
Where to start: The maturity path from static scoring to prediction
Where to start: The maturity path from static scoring to prediction
The idea of a local predictive model can be daunting, particularly if you’re still at the stage of patching by pivoting off KEV or CVSS.
No Way(s) Home
No Way(s) Home
Don’t let reachability fool you into a false positive sense of security.
September 2026 CVE of the Month: The 9.8 Nobody Knows They Are Running (CVE-2026-58138)
September 2026 CVE of the Month: The 9.8 Nobody Knows They Are Running (CVE-2026-58138)
Kinda Chic to Prioritize with Proof
So why Empirical? The technology solves a problem I watched go unsolved for a decade, and I want to be a part of the answer. And the people behind it are some of the smartest, most genuine people I know — people I've already spent years trusting. Win-win, as they say.
Empirical Foundation: The Next Frontier Of Cyber Defense Modelling
Over 100 vendors trust our models today. Open almost any exposure-management platform and EPSS is already inside it. Some examples include: Microsoft (Defender, plus GitHub Dependabot and the GitHub Advisory Database), Amazon (AWS Inspector), Alphabet/Google (Mandiant, and Wiz), Cisco, ServiceNow, IBM (Concert), Palo Alto Networks (Prisma Cloud and Xpanse), Fortinet, Datadog, Crowdstrike, Elastic, Tanium, SentinelOne, Snyk, Tenable, Qualys, Armis, Axonius, Veracode, Rapid7, Docker, Orca, Aqua Security, NetSPI, SecurityScorecard, Flashpoint, HackerOne, Semgrep, Balbix, Brinqa, Black Kite, Endor Labs, Cowbell, Nucleus Security.
August 2026 CVE of the Month: The 7-Zip Bug Every Scorecard Says to Ignore (CVE-2026-58052)
In January 2023, this column's first life at Kenna featured CVE-2022-44698, a Windows SmartScreen Mark-of-the-Web bypass that attackers were happily using while the scoring systems shrugged. Three and a half years later, here we are again. This month's pick scores 3.3 under CVSS v3.1, the kind of number that never makes a patch queue, and our sensors have recorded it being exploited in the wild multiple times in the past month.