Vulnerability Forecasting: Theory and Practice

It is possible to forecast the volume of CVEs released within a time frame with given prediction interval. For example, number published between now and year from can be 8% actual value. Different predictive algorithms perform well at different lookahead values other than 365 days, such as monthly, quarterly, half year. also estimate proportions that total belonging specific vendors, software, CVSS scores, or vulnerability types. Some vendors products predicted accuracy, others too much uncertainty practically useful. This article documents which are amenable being forecasted. Strategic patch management should become easier these tools, further reductions built methodologies in this article.