4 of mallace

1) The vast majority of CVEs (vulnerabilities) are never observed to be exploited in the wild 2) A smaller percentage of CVEs are being exploited in the wild today than a year ago, probably because attackers haven't absorbed the massive new CVE supply 3) It's easiest to measure exploitation of CVEs that pertain to Internet-facing applications, since honeypot companies collect data on mass exploitation attempts and can see this as soon as these campaigns start (vs data collected after full on incidents) 4) Judging from this 'CVEs in internet-facing attack surfaces' view, it appears that exploitation of new CVEs is probably beginning to increase in the wild but the data are somewhat uncertain and this isn't happening in proportion to the new CVE supply 5) Hyperscalars like Amazon, Apple, Google are all good examples of vendors where there are new CVEs but we don't seem to be seeing mass exploitation; I think this is because they do a really good job (relative to the rest of software companies) of auto-security-updating their code and also spend, collectively > $1 billion on application security teams, tokens, and infra; so I think they're an anchor for how to do appsec in the AI security era 6) The long tail of the enterprise software security market is way, way weaker; fewer resources to do appsec (imagine zero or a few appsec engineers versus hundreds at the hyperscalars), software that doesn't auto-install security updates, companies owned by PE firms that've gutted security teams; this is where mass exploitation is happening 7) The core structural problem will be to find ways to use AI automation, and policy carrots and sticks, to bring 'long tail' enterprise software vendors up to something like the security hygiene of the hyperscalars I've been pouring over these data for the past few weeks and still have substantial uncertainty, but I give a lot more depth here -- joshuasaxe181906.substack.co… -- plus a github repo showing how I attempted to kludge together a ton of partial, noisy data sources to estimate what's going on in vulnpocalypse-land.