#Hacktivity2020 // Perception vs Reality by Piotr Pobereźny

### Overview In this presentation, Piotr Pobereźny, a Senior Security Solution Architect at Qualys and former group CISO for two large insurance companies, addresses the disconnect between executive perception and operational reality in cybersecurity. While C-level leadership often assumes basic tools like antivirus, firewalls, and cyber insurance provide adequate protection, Pobereźny reveals that organizations manage an average of only around 12% of their total attack surface. The rest remains unmanaged due to complex hybrid architectures, visibility gaps, and inefficient legacy vulnerability management practices.

### Key Topics - **Misaligned Patching Priorities:** Most enterprises focus patching efforts primarily on operating systems (ranked 11th in terms of vulnerabilities with public exploits) while neglecting software with significantly higher numbers of exploitable vulnerabilities multiplied by deployment volume. - **Top Vulnerability Volumes:** Software presenting the highest volume of public exploits includes Adobe products (Flash, Reader) at number one, web browsers (Chrome, Firefox, Internet Explorer) at number two, and Intel graphics card drivers at number three—a component virtually ubiquitous across both workstations and servers. - **Sensor-Driven Visibility vs. Scanning:** Moving away from heavy, periodic network appliance scans toward continuous, lightweight sensor and connector deployment (cloud, container, host) allows real-time asset discovery and vulnerability detection without consuming excessive host resources. - **Prioritization and Remediation Integration:** Combining asset inventory, risk-based prioritization (via Real-Time Threat Indicators or RTIs), and built-in patch orchestration within a unified platform, replacing disconnected point solutions and static spreadsheets. - **Executive Communication ("Dialects"):** Translating raw technical vulnerability metrics into executive-level operational, financial, and regulatory risk (such as GDPR infrastructure compliance percentages) mapped to recognized benchmarks.

### Technical Details Traditional vulnerability management relies on manual flat exports (CSV, XML, Excel) that show flatlines where the incoming flow of vulnerabilities continually outpaces remediation. Pobereźny outlines an operational model built around four stages: comprehensive asset inventory, vulnerability detection, threat-based prioritization, and remediation.

Using an example of Windows workstations with over 100,000 confirmed vulnerabilities, Pobereźny demonstrates filtering with Real-Time Threat Indicators (RTIs)—such as active exploits, malware associations, and exploit kits. This filters the actionable remediation set down to 352 unique vulnerabilities representing less than 18% of the total scope, transforming an unmanageable backlog into an actionable plan. The solution supports direct patch deployment workflows—from scheduled maintenance windows (e.g., Patch Tuesday) to ad-hoc browser or driver updates—without needing external deployment tools. Additionally, unpatchable software reaching end-of-life (such as Apple QuickTime or older Flash versions) can be automatically identified for removal or migration.

### Takeaways Pobereźny stresses that the target Time to Remediate (TTR) should approach zero rather than relying on Mean Time to Resolution (MTTR), which often masks severely outdated vulnerabilities. To secure executive buy-in and appropriate budget allocation, security practitioners must stop delivering thousands of pages of raw CVE reports. Instead, technical data should be translated into high-level compliance and risk percentages tied to industry standards (like ISO 27001 or CIS benchmarks), clearly presenting residual business risk directly to decision-makers.