What is CTEM? A Guide to Proactive Cybersecurity

Most security teams are great at finding problems. The real challenge is figuring out which problems to solve first. When everything is a priority, nothing is. This is a common frustration that leaves teams feeling overworked and unsure if their efforts are making a real difference. A more...

Exposure Management vs Vulnerability Management: Key Differences

Is your security program truly reducing risk, or is it just getting really good at patching? This question is at the heart of the exposure management vs vulnerability management debate. A traditional approach can tell you that a door has a weak lock, but it can't tell you if that door leads to a...

The End of the Road for Cisco Kenna: Take a Measured Path into Exposure Management

Cisco’s announcement that it will sunset Cisco Vulnerability Management Kenna marks a clear inflection point for many security teams. With end-of-sale and end-of-life timelines now defined, and no replacement offering on the roadmap, Kenna customers face an unavoidable decision window. Beyond the...

CTEM in Practice: Prioritization, Validation, and Outcomes That Matter

Cybersecurity teams increasingly want to move beyond looking at threats and vulnerabilities in isolation. It's not only about what could go wrong vulnerabilities or who might attack threats, but where they intersect in your actual environment to create real, exploitable exposure. Which exposures...

Access Fabric: A modern approach to identity and network access

Today, most organizations use multiple identity systems and multiple network access solutions from multiple vendors. This happens, either intentionally or organically, when different areas of a company choose different tools, creating a fragmented environment that leaves weaknesses that...

Access Fabric: A modern approach to identity and network access

Today, most organizations use multiple identity systems and multiple network access solutions from multiple vendors. This happens, either intentionally or organically, when different areas of a company choose different tools, creating a fragmented environment that leaves weaknesses that...

How to Modernize Your Vulnerability Management Program A Helpful Resource Guide For CISOS and Vuln teams

Running a vulnerability scan can feel like opening Pandora's box. You’re suddenly faced with a report listing thousands of potential weaknesses, and the pressure to "fix everything" is immense. But this approach is a recipe for burnout, leaving your team chasing low-impact issues while a real...

How Can Retailers Cyber-Prepare for the Most Vulnerable Time of the Year?

The holiday season compresses risk into a short, high-stakes window. Systems run hot, teams run lean, and attackers time automated campaigns to get maximum return. Multiple industry threat reports show that bot-driven fraud, credential stuffing and account takeover attempts intensify around peak...

What is Patch Management Automation and Why It Matters

Executive Summary Environments rarely stay as orderly as they begin. New workloads, faster releases, and growing attack surfaces stretch manual patching beyond its limits. The real risk emerges in the widening gap between spotting a vulnerability and fixing it. Automated patch management closes...

Your Guide to Risk-Based Vulnerability Management

Communicating security needs to leadership can be a challenge when you’re just presenting a long list of technical flaws. The conversation shifts when you can talk about risk in clear business terms. Instead of saying "we have 500 critical vulnerabilities," you can say "we have 15 vulnerabilities...

​​Securing critical infrastructure: Why Europe’s risk-based regulations matter

The Deputy CISO blog series is where Microsoft Deputy Chief Information Security Officers CISOs share their thoughts on what is most important in their respective domains. In this series, you will get practical advice, tactics to start and stop deploying, forward-looking commentary on where the...

Beyond CVSS: Critical CVE Vulnerabilities Analysis

Attackers don't care about your CVSS scores. They care about finding a path into your network. That path might not be a single, glaring "critical" vulnerability. Often, it’s a chain of lower-severity weaknesses on overlooked assets that, when combined, give them the keys to the kingdom. This is w...

EUVD-2013-5269

Malware in sbrugna...

Risks and Compliance with the EU'S Core Cyber Security Legislation

The European Union EU has long favored a risk-based approach to regulation. Such an approach is also used in recent cyber security legislation enacted in the EU. Risks are also inherently related to compliance with the new legislation. Objective: The paper investigates how risks are framed in the...

Exploring an Untethered, Unified Approach to CTEM

We live in a world where traditional Vulnerability Management VM has become infosec’s version of ‘whack-a-mole’— an attempt to tackle risks that constantly shift, multiply, and morph. As organizations push workloads to the cloud, offer customers digital experiences, or as they build AI-enabled...

Exploring an Untethered, Unified Approach to CTEM

We live in a world where traditional Vulnerability Management VM has become infosec’s version of ‘whack-a-mole’— an attempt to tackle risks that constantly shift, multiply, and morph. As organizations push workloads to the cloud, offer customers digital experiences, or as they build AI-enabled...

Driving down MTTR with Remediation Hub, Available in Rapid7 Exposure Command

Co-authored by Peter Whibley, Ed Montgomery, and Joel Alcon Technology innovation combined with the highly fragmented nature of today's IT landscape means that vulnerabilities are being exploited faster and at greater scale than ever. Security teams contend with a daily surge of new threat actors...

A New Approach to Managing Vulnerabilities is Required - Work Smarter not Harder with Rapid7 Remediation Hub

The volume of common vulnerabilities and exposures CVEs identified has now reached a level that even the organization tasked with managing them can no longer keep up. The National Vulnerability Database NVD announced in February 2024 that it would no longer provide common vulnerability scoring...

Steps to TruRisk™ – 1: Shift to Priority-Driven Strategies

“If you know the enemy and know yourself, you need not fear the result of a hundred battles.” — Sun Tzu Security and IT teams are drowning in alerts, scrambling to patch everything they can, yet breaches still happen. Not all vulnerabilities pose the same risk. While reducing totals may seem like...

Rapid7 Fills Gaps in the CVE Assessment Process with AI-Generated Vulnerability Scoring in Exposure Command

NIST released an update highlighting that there would be delays in adding information on newly published CVEs this is also discussed in detail in our blog post from March of 2024. Due to resource constraints and an inability to keep up with the volume of newly-disclosed vulnerabilities, NVD shift...