<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:image="http://www.google.com/schemas/sitemap-image/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:video="http://www.google.com/schemas/sitemap-video/1.1">
  <url>
    <loc>https://research.empiricalsecurity.com/research</loc>
    <changefreq>daily</changefreq>
    <priority>1.0</priority>
    <lastmod>2026-04-01</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/reality-check</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2026-04-01</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/bdbfce74-c0d2-446d-bfa4-d74f1598efc4/proportion-of-assets-with-open-vulns-among-500-firms.png</image:loc>
      <image:title>Research Articles | Empirical Security - The 500 Organization Reality Check - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/2a4e3c97-608d-4c2c-ab5c-a0a4be6813e5/distribution-of-epss-scores-among-cves-observed-in-production-assets.png</image:loc>
      <image:title>Research Articles | Empirical Security - The 500 Organization Reality Check - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/85e80607-9ba6-4429-bac3-9e8e3cbadfc2/proportion-of-assets-with-at-least-one-highly-exploitable-vuln.png</image:loc>
      <image:title>Research Articles | Empirical Security - The 500 Organization Reality Check - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/ai-is-eating-your-scanner</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2026-03-19</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/servicenow-vulnerability-response-app</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2026-03-05</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/959da43c-4d50-48f2-a712-9d06e5e06180/4-empirical-security-screenshot.jpg.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Using ServiceNow? We’ve got you covered. - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/headcount-does-not-help</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2026-03-04</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/59167640-a3d3-4360-8818-4d93530fd7fd/exploitability-reduction-achieved-by-improving-remediation-strategy-and-capacity+%281%29.png</image:loc>
      <image:title>Research Articles | Empirical Security - When Headcount Doesn’t Help - Make it stand out</image:title>
      <image:caption>Figure 19</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/capacity-is-king</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2026-02-07</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/fe16bc1a-efc0-46d9-aa99-aa1317d713a9/avg-monthly-observed-vs.-closed-vulnerabilities-per-firm.png</image:loc>
      <image:title>Research Articles | Empirical Security - Capacity is King - Make it stand out</image:title>
      <image:caption>The median enterprise has 15% remediation capacity.</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/02907920-3d80-400a-bedd-41ab5468a912/distribution-of-remediation-capacity-among-organizations.png</image:loc>
      <image:title>Research Articles | Empirical Security - Capacity is King - Make it stand out</image:title>
      <image:caption>Variability is high, but skews left.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/remediation-halflife</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2026-01-26</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/b1e260e3-bbd2-4798-9041-bfb82a7d4b52/survival-analysis-curves-for-vulnerability-remediation-timelines-fig-1.png</image:loc>
      <image:title>Research Articles | Empirical Security - Remediation Half‑Life - Make it stand out</image:title>
      <image:caption>It takes around 5 months to remediate half of an average organization’s vulnerabilities.</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1d3099a7-7931-4bbb-8276-a04aa60543b3/survival-analysis-curves-for-vulnerability-remediation-timelines-fig-2.png</image:loc>
      <image:title>Research Articles | Empirical Security - Remediation Half‑Life - Make it stand out</image:title>
      <image:caption>Survival curve variability across 500 organizations</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/the-kev-paradox</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2026-01-14</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/ee365b74-24e6-4a33-9f0a-c6f0e7bbffd1/prevalence-of-kev-cves-in-organizations-by-various-measures.png</image:loc>
      <image:title>Research Articles | Empirical Security - The KEV Paradox - Make it stand out</image:title>
      <image:caption>1% of open vulnerabilities out of a sample of 635 million are on the KEV list as of 2022.</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/98da4d00-f764-459b-8418-cda914be87c4/overlap-between-vulnerabilities-with-exploit-code-and-exploitation-activity-and-appearance-on-the-kev.png</image:loc>
      <image:title>Research Articles | Empirical Security - The KEV Paradox - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/b1c34945-f0a2-44d0-abd6-d68736799f06/cves-on-the-kev.png</image:loc>
      <image:title>Research Articles | Empirical Security - The KEV Paradox - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/5c23dc97-debe-4b40-8474-db6a44deb1ad/all-published-cves.png</image:loc>
      <image:title>Research Articles | Empirical Security - The KEV Paradox - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/trojan-rat</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2026-01-05</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/efea6b2b-d617-40d9-8ed3-50b699faf44d/github-exploitdb-metasploit.png</image:loc>
      <image:title>Research Articles | Empirical Security - Trojan RAT: Stopping Exploit Spoofing with Machine Learning - Make it stand out</image:title>
      <image:caption>Github’s rise as a source of exploit POCs in 2021</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/f72cd52d-6ce4-4df2-aaec-d8a4ed04fe3c/image+%281%29.png</image:loc>
      <image:title>Research Articles | Empirical Security - Trojan RAT: Stopping Exploit Spoofing with Machine Learning - Make it stand out</image:title>
      <image:caption>Scoring of 15 WebRAT exploit spoofing attacks by Empirical’s ML model</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/f6196706-11a4-42e2-9b30-4dab1de74fe9/image+%282%29.png</image:loc>
      <image:title>Research Articles | Empirical Security - Trojan RAT: Stopping Exploit Spoofing with Machine Learning - Make it stand out</image:title>
      <image:caption>Most CVE mentions on Github are not exploits</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/say-goodbye-to-kenna-say-hello-to-local-models-at-scale</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-12-18</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/bb2ba474-e76c-4ab2-99e2-3ab29ab727ac/Screenshot+2025-12-18+at+1.20.40%E2%80%AFPM.png</image:loc>
      <image:title>Research Articles | Empirical Security - Say Goodbye to Kenna — Say Hello to Local Models at Scale - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/65c69d56-2bf8-49bc-a130-b34b08071aa8/IMG_1929.JPG</image:loc>
      <image:title>Research Articles | Empirical Security - Say Goodbye to Kenna — Say Hello to Local Models at Scale - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/66854206-bb20-4c27-b1ff-2a232dc0f504/IMG_2685.JPG</image:loc>
      <image:title>Research Articles | Empirical Security - Say Goodbye to Kenna — Say Hello to Local Models at Scale - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/45260f21-986d-4f55-9c94-e322aab47002/Screenshot+2025-12-18+at+1.38.32%E2%80%AFPM.png</image:loc>
      <image:title>Research Articles | Empirical Security - Say Goodbye to Kenna — Say Hello to Local Models at Scale - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/critical-indicators-and-known-exploitation-heatmap</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-12-18</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/42510aef-2c23-45f2-9c50-9f7567bc2444/5-critical-indicators.png</image:loc>
      <image:title>Research Articles | Empirical Security - New Features: Critical Indicators &amp;amp; Known Exploitation Calendar Heatmap - Make it stand out</image:title>
      <image:caption>CVE Detail Page</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/cc74d52b-756d-4e68-9f78-743a88a43b64/key-2.png</image:loc>
      <image:title>Research Articles | Empirical Security - New Features: Critical Indicators &amp;amp; Known Exploitation Calendar Heatmap - Make it stand out</image:title>
      <image:caption>Critical Indicators Key</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/6cbc9945-4a6e-4a36-becb-d4108a09cc58/6-critical-indicators.png</image:loc>
      <image:title>Research Articles | Empirical Security - New Features: Critical Indicators &amp;amp; Known Exploitation Calendar Heatmap - Make it stand out</image:title>
      <image:caption>Critical Indicators API Example</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1b6ebfe4-46d3-4050-ae00-d68d0909ed32/8-critical-indicators.png</image:loc>
      <image:title>Research Articles | Empirical Security - New Features: Critical Indicators &amp;amp; Known Exploitation Calendar Heatmap - Make it stand out</image:title>
      <image:caption>CVE Detail Page</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/risk-model-slop</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-12-16</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/dea94c18-a318-4144-a0c7-79d81e0e7967/model-slop-image.png</image:loc>
      <image:title>Research Articles | Empirical Security - Risk Model Slop - Make it stand out</image:title>
      <image:caption>When adding data goes awry</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/local-models-vs-global-scores</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-10-08</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/shadow-price-how-to</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-10-02</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/shadow-pricing-business-case</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-09-02</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/duality-of-risk-and-capacity</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-08-27</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/auc-gtfo</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-08-25</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/blackhat-recap-2025</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-08-18</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305651920-7BOA6J91XO1P4MX1TI6Y/36405MR000001-R1-007-2.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305652594-ZDOHCUH62RHMG89GSPHS/36405MR000001-R1-005-1.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305657883-EEVS7THWRSDLY6QQ1IT8/36405MR000001-R1-009-3.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305658471-7Z7S38S2ZLZ2YFGL1E9Z/36405MR000001-R1-011-4.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305663911-R8XCH4S9AT29QT1LGJ53/36405MR000001-R1-015-6.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305666005-8O0TIZEEOIRXIR6TLQAJ/36405MR000001-R1-017-7.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305670240-1676JZHWXRDL1E1C3LT9/36405MR000001-R1-019-8.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305671781-9CHZIL63QKJ8T4UM3320/36405MR000001-R1-021-9.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305677157-44T6EIB6GT3PQ74P464Y/36405MR000001-R1-023-10.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305676528-2GWZO1US5V8H9G77ZN37/36405MR000001-R1-025-11.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305682408-0J0ZMIP2UVSGJBZRX3IZ/36405MR000001-R1-029-13.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305683415-F7VACC2CZY4FCIQHAKFJ/36405MR000001-R1-031-14.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305687282-L03VH6UNANSBS4ON2H7G/36405MR000001-R1-033-15.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305690450-ZQL9RZR6EC2IJT0MUKS3/36405MR000001-R1-039-18.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305693060-54KXBUUULQ37CZ0VI4PO/36405MR000001-R1-043-20.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305696732-BWB0HIZKEPCTOJPIK9BF/36405MR000001-R1-047-22.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305698295-F705POWSW6O4W1NDR3SY/36405MR000001-R1-049-23.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305703060-WCRQ9F44USLIMBYM9CF5/36405MR000001-R1-053-25.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305704828-CW9TLDQXGI09HBBRHB45/36405MR000001-R1-055-26.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305708247-IKY2RKSIQAHFSSV8EQFD/36405MR000001-R1-059-28.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305710705-UAFZ6HHFFB8V2ZL33FID/36405MR000001-R1-061-29.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305713802-CWCS4QVEI83K77Z8LDSZ/36405MR000001-R1-063-30.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305716878-GP4ENJJYSAXYTSXEQ2LM/36405MR000001-R1-065-31.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305720223-P4L36YT4GRROHJSCAMUF/36405MR000001-R1-069-33.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/1755305721286-5JVI68ALVE004Q0LP0RN/36405MR000001-R1-073-35.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Blackhat Rat Pack Recap</image:title>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/github-exploits</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-08-18</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/593145d9-3d6b-4ade-b69c-2f87bef51867/roc_curve_with_labels.png</image:loc>
      <image:title>Research Articles | Empirical Security - Finding New Exploits with A Bespoke Model - Make it stand out</image:title>
      <image:caption>Comparison of performance between the previous classifier and the new and improved classifier.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/its-not-about-making-a-scoring-system</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-08-18</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/why-i-decided-to-join-empirical-security</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-17</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/c2e4a655-3563-498a-89b3-19a3b4661c13/leadership-team.png</image:loc>
      <image:title>Research Articles | Empirical Security - Why I Decided to Join Empirical Security - Make it stand out</image:title>
      <image:caption>Ed Bellis, Jay Jacobs, and Michael Roytman</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/benchmarking-llms</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-15</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/0fa22dbd-c8ff-4100-80d8-e8765b70b3d1/distributions.png</image:loc>
      <image:title>Research Articles | Empirical Security - Benchmarking LLMs on the Vulnerability Prioritization Task - Make it stand out</image:title>
      <image:caption>LLM generated probabilities skew upwards.</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/232b46b7-a013-4048-8118-30ea2f415f2b/jaypt_cov_eff.png</image:loc>
      <image:title>Research Articles | Empirical Security - Benchmarking LLMs on the Vulnerability Prioritization Task - Make it stand out</image:title>
      <image:caption>LLMs lack the efficiency needed for the vulnerability prioritization task, the explanation is a tautology: prediction requires predictive modeling. Vulnerability prioritization is inherently a predictive task (“will an event occur?”).</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/b06f7d83-ce48-4857-8988-817ead336f50/jaypt_cov_effort.png</image:loc>
      <image:title>Research Articles | Empirical Security - Benchmarking LLMs on the Vulnerability Prioritization Task - Make it stand out</image:title>
      <image:caption>Limited coverage of LLMs on the vulnerability prioritization task.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/re-exploited-series-2</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2026-01-15</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/b7801319-0b1b-4e33-b025-3f2f72f1d9c0/recency_by_30days.png</image:loc>
      <image:title>Research Articles | Empirical Security - Known Exploited vs Recently Exploited - Make it stand out</image:title>
      <image:caption>Re-exploitation events follows a rather predictable pattern and they are neither independent nor random (in the big picture).</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/building-with-intention</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-08</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/036f7585-505a-4e00-9ee7-6dcc529e323b/team-1.png</image:loc>
      <image:title>Research Articles | Empirical Security - Building with Intention: The Way We Work at Empirical - Make it stand out</image:title>
      <image:caption>Spring 2025, The Hoxton in Chicago, IL</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/re-exploited-series-1</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2026-01-15</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/dc5de089-4be5-4c73-8316-ef00623b91f5/re-exploitation_given_any_prior_activity.png</image:loc>
      <image:title>Research Articles | Empirical Security - Known (Re-)Exploited Vulnerabilities - Make it stand out</image:title>
      <image:caption>The chance of exploitation in the next 1, 7, or 30 days changes and fluctuates over time for CVEs with known exploitation (using a sliding 12-month window).</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/watch-empirical-at-vulncon-2025</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-09-23</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/only-your-data-can-truly-anticipate-threats</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/69af01ff-3280-4a0d-9b42-d23f9890a308/img.jpg</image:loc>
      <image:title>Research Articles | Empirical Security - Only Your Data Can Truly Anticipate Threats - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/explore-thresholds-feature</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-08-25</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/2ff7f419-1db4-4a81-9606-20cda54862db/thresholds-r2.png</image:loc>
      <image:title>Research Articles | Empirical Security - Explore Model Thresholds - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/explore-our-new-api-docs</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-05-28</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/9a2f1687-48ce-44c2-9e1c-483afdf15054/Screenshot+2025-05-28+at+12.11.20%E2%80%AFAM.png</image:loc>
      <image:title>Research Articles | Empirical Security - Explore Our New API Docs - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/supporting-epss-our-vision-for-a-more-data-driven-future</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/e64c704f-156e-4dff-be95-bd51feb675df/blackhat-founders-img.png</image:loc>
      <image:title>Research Articles | Empirical Security - Supporting EPSS: Our Vision for a More Data-Driven Future - Make it stand out</image:title>
      <image:caption>Our co-founders, Jay and Michael, presenting the first EPSS paper at Blackhat 2019.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/announcing-the-empirical-security-global-model</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/086c6d75-e388-4c22-a293-80e9673b7660/announcing-the-empirical-security-global-model.png</image:loc>
      <image:title>Research Articles | Empirical Security - Announcing The Empirical Security Global Model - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/epss-effort-vs-coverage</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-10-02</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/2fdfa5d2-7280-4011-a24b-c04ae0283118/coverage-img</image:loc>
      <image:title>Research Articles | Empirical Security - EPSS: Effort vs Coverage - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/787b30d9-f468-4dcc-8b24-180c952ea7dd/shift-img.png</image:loc>
      <image:title>Research Articles | Empirical Security - EPSS: Effort vs Coverage - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/d4e62cba-30b2-4a5f-8d4a-705a3896f003/epss-effort-vs-coverage.png</image:loc>
      <image:title>Research Articles | Empirical Security - EPSS: Effort vs Coverage - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/introducing-epss-version-4</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/51d0dd72-f3a4-4818-ba00-39bb6652f75b/cvss-comparison-img.png</image:loc>
      <image:title>Research Articles | Empirical Security - Introducing EPSS v4 - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/probability-and-prediction</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
    <image:image>
      <image:loc>https://images.squarespace-cdn.com/content/v1/6835e6cf18b10c4263e17646/288fa22f-e942-426e-a88d-f5ea7a0a3180/probability-and-prediction.png</image:loc>
      <image:title>Research Articles | Empirical Security - Probability and Prediction - Make it stand out</image:title>
      <image:caption>Whatever it is, the way you tell your story online can make all the difference.</image:caption>
    </image:image>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/looking-beyond-the-soc</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/cybersecurity-is-ready-for-local-models</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/the-future-of-ai-and-ml-in-cybersecurity</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/exploit-prediction-scoring-system</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/improving-vulnerability-remediation-through-better-exploit-prediction</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/the-complexity-of-prioritising-patching</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/what-i-ve-learned-while-training-computers-to-predict-cyber-risk</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/for-good-measure-remember-the-recall</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/exploring-with-a-purpose</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/measuring-vs-modelling</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
    <lastmod>2025-07-02</lastmod>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/tag/exploitation</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/tag/exploited-in-the-wild</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/tag/github+exploits</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/tag/vulnerability+management</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/tag/model</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/tag/vulnerability</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://research.empiricalsecurity.com/research/tag/cybersecurity</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>
</urlset>

