Kenna Is Sunsetting. Your Next Move Just Got Easier.
There's a smarter way forward than another traditional RBVM tool. And we know a thing or two about Kenna.
A lot of the people building Empirical are the same people who built Kenna. Same brains, same battlescars, different decades. So when we tell you we know where the gaps are, we're not guessing from the outside. We were in the room. Some of us wrote the code. A few of us probably owe you an apology for a scoring quirk or two.
Whether Kenna was the best tool you ever used or the bane of your Tuesday mornings, we've heard it all, because we said a lot of it ourselves first. So let's talk about what happens next, and why it doesn't have to be the multi-year, all-hands-on-deck migration nightmare you're bracing for if you're looking for a new solution.
What Empirical Does
Empirical builds security models specific to your organization. They give your team a calibrated 30-day probability of where attackers will break in, so you can get there first.
Instead of one score built for everyone, we build a local model trained on your environment: your assets, your configurations, and the signals your security tools already see. It predicts what's likely to hit you, not the industry average.
If You're Reading This...
You already know Kenna is sunsetting. Security leaders have said they fear losing Kenna means getting buried under an unmanageable pile of undifferentiated vulnerabilities. We've had three separate teams bring this to us as a live priority in just the last month, several who'd put it off entirely until AI-driven vulnerability disclosure made the volume problem impossible to ignore any longer. We know there are more of you out there in similar circumstances and we can help.
The World Kenna (or any RBVM tool) Was Built For Doesn't Exist Anymore
Knowing what's dangerous or whether a vulnerability has been exploited in the wild is a starting point. It stopped being a differentiator a while ago. Today, at least 135 vendors report using EPSS, something Empirical built and maintains through FIRST.org for free. That number is almost certainly low, since it only counts vendors who bothered to submit the paperwork. Exploitation data is no longer the moat it once was, especially when so much of it is freely available. What still separates one score from another is how well a model turns that data into a prediction.
The question that actually matters is "will it be exploited?" And that question can't have one answer, because there is no such thing as a generic environment.
Two companies can have the exact same CVE sitting on the exact same software version, and one of them is sitting behind three layers of segmentation nobody's touched since 2019, while the other has that box facing the internet with a stale firewall rule from an acquisition two years back. Same vulnerability. Wildly different odds of ever getting hit. A score built for "the industry" can't see either one of those realities. It just sees the CVE.
We Ran the Numbers
We scored every published CVE, all 366,595 of them, with our model and with Kenna. Then we watched what attackers actually exploited over the next 30 days, which ended up being 8,352 CVEs.
If your team fixes the top 2% of the list:
Our model catches 76.7% of what actually got exploited. Kenna catches 32.0%.
88.2% of what our model told you to fix was actually exploited. For Kenna, it's 39.5%.
And by the way, those numbers are before Empirical’s model knows anything about your specific environment.
Same effort. More than twice the coverage, and about a fifth of the wasted patching.
Good News: The Data Is Already in Your Stack.
That's where the local model comes in. Empirical doesn't ask you to collect anything new. It reads the telemetry your EDR, SIEM, firewall, and cloud tooling already produce, and it trains a model on what that data says about your environment. It fills the slot Kenna is leaving, so your stack stays the same size. Those same tools know more about your network than any generic vulnerability score can, and the model keeps adjusting as conditions change.
And when your organization sees exploitation activity the rest of the world hasn't, your model can learn from that too. There is no single source that sees every exploitation attempt, which is exactly why your own data matters so much.
The industry spent a decade getting good at scoring vulnerabilities the same way for everyone. The teams walking away from Kenna right now have a rare chance to skip another generic-scoring era entirely and go straight to a model that actually knows their environment.
One global security leader told us that on paper, Kenna was doing its job: it took millions of findings down to tens of thousands. But that still left tens of thousands of “highs” sitting open, and asking teams to self-serve from the list wasn't a strategy they felt confident in. Another drop-in score wasn't what his team wanted. They wanted something that actually changed how they reduce risk, which is exactly why a local model caught their attention.
Now what?
Come talk to us. We can show the performance of our model against your data and against Kenna.
