Cybersecurity Buyers Need Evidence Beyond Vulnerability Counts

A larger vulnerability inventory is not the same thing as a larger set of observed attacks. Our analysis of recent Cisco Talos and Microsoft research proposes a buying question. Can a security programme connect technical exposure, attacker activity and response decisions, rather than simply count everything it discovers?

Discovery and exploitation answer different questions

Cisco Talos’s October 15 vulnerability analysis distinguishes growth in published vulnerabilities from growth in the known-exploited catalogue. Talos also discusses patch debt affecting older vulnerabilities. Our interpretation is that discovery totals alone cannot explain the operational threat.

For buyers, our recommendation is to ask vendors how they distinguish an inventory finding from evidence of exploitation. FIRST’s Exploit Prediction Scoring System estimates exploitation probability, while its Common Vulnerability Scoring System addresses vulnerability severity. We recommend treating these as different inputs, not interchangeable verdicts about an organisation’s risk.

The backlog needs business context

Talos’s October patch analysis illustrates the continuing work of reviewing vendor updates. A large release does not establish which systems an individual company operates, which are exposed or which remediation could interrupt an important service. Those questions require organisation-specific evidence.

This analysis recommends a prioritisation record that connects a finding to the affected asset, its business role, exploitation evidence and a responsible owner. Buyers should request examples of completed decisions rather than assume that a longer vulnerability list demonstrates greater protection. No reduction in breaches or operating costs is established here.

Phishing is also an infrastructure problem

Microsoft’s October 14 phishing ecosystem investigation describes relationships among phishing-kit developers, an infrastructure dealer and downstream customers. Microsoft reports abuse of compromised or fraudulently obtained cloud environments. We recommend treating this as company-reported evidence, not as a census of all cybercrime.

MITRE’s descriptions of phishing and valid-account abuse provide useful background for separating delivery from subsequent access. Our inference is that email filtering should not be the only procurement question. Buyers should also examine application privileges, administrative access and the evidence available when accounts are misused.

Response must survive an actual intrusion

Talos’s separate UAT-6275 investigation documents activity targeting government organisations. The researchers also report recovered artifacts showing interest in water resources and energy. We recommend assessing this campaign separately from Microsoft’s phishing ecosystem when evaluating defensive requirements.

The NIST incident-response guidance offers a reference for evaluating preparation and response. A practical purchasing exercise could test whether an organisation can investigate suspicious activity, identify affected assets and coordinate containment. We recommend testing these capabilities locally, rather than treating the reports as proof that any vendor will prevent every intrusion.

Measure decisions and recovery, not alert volume

The NIST Cybersecurity Framework provides broader risk-management context. Our recommendation is to assess a security purchase against explicit operational questions. What gets prioritised, who can act, and what evidence demonstrates that the action addressed the exposure?

A useful evaluation could follow one finding from discovery through investigation and closure. Ask the supplier to explain the evidence behind its priority, then ask the internal team to identify the person responsible for acting on it. Include a case where the recommended action cannot immediately be completed. That would test how exceptions are handled, rather than only how alerts appear. It is a proposed purchasing exercise, not a claim that the cited researchers measured the effectiveness of this method.

For related reading, we recommend session security, agent safety, runtime controls, data classification and measurable operational returns. Our recommendation favours accountable decisions over impressive dashboards, without claiming that the reviewed research establishes a universal purchasing formula.