Vulnerability Intelligence

What is vulnerability intelligence?

Vulnerability intelligence is threat intelligence focused on software vulnerabilities: which ones are being exploited in the wild, by which attackers, how quickly and against what kinds of targets. It adds real-world context to the long lists that vulnerability scanners produce.

The problem it solves is scale. Organizations typically have far more open vulnerabilities than they can patch. Severity scores alone do not say which ones attackers are actually using.

What does vulnerability intelligence include?

• Exploitation status: whether a vulnerability is being exploited, and whether a public exploit exists.
• Threat actor links: which groups use it, including ransomware operators and APT groups.
• Targeting: which sectors and regions are being hit.
• Timing: how fast exploitation followed disclosure.
• Detection guidance: indicators and behaviors that show exploitation, so the SOC can look for it while patches roll out.

Public sources include CISA's Known Exploited Vulnerabilities (KEV) catalog and the Exploit Prediction Scoring System (EPSS). Commercial intelligence adds actor context and earlier warning.

How do teams use vulnerability intelligence?

1. Prioritize patching by exploitation and exposure, not severity alone.
2. Hunt for exploitation in historical data when a vulnerability you run turns out to be actively exploited.
3. Add temporary detections while patches are tested and deployed.
4. Brief leadership on the vulnerabilities most likely to matter this month.

Frequently asked questions

Is vulnerability intelligence the same as a CVSS score?

No. CVSS describes how severe a vulnerability could be. Vulnerability intelligence describes whether and how attackers are actually using it.

Who uses vulnerability intelligence?

Vulnerability management teams to prioritize patching, SOC teams to detect exploitation and CTI teams to track the attackers involved.

Anomali and Vulnerability Intelligence

Anomali connects vulnerability and exposure data with threat intelligence so teams can see which weaknesses attackers are targeting.

See vulnerability and exposure management with Anomali or request a demo.

Read next

• Vulnerability and exposure management: How Anomali applies it.
• Priority intelligence requirements: Making exploited vulnerabilities a standing question.
• SOC modernization: Back to the hub.

‍