Pith. sign in

REVIEW 4 major objections 6 minor 33 references

Modeling Local Exploit Hazard - A Bayesian Framework for Quantifying Exploit Risk and Operational Efficiency

T0 review · 4 major / 6 minor · reviewed 2026-07-31 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Global exploit probabilities can be turned into an organization’s own daily exploit hazard and used to rank what to fix first.

desk verdict Clean engineering synthesis of EPSS, Bayesian controls, and survival hazards into a remediation-ranking loop—math is mostly solid, validation is missing, and Eq. 2 likely double-counts global controls. read the letter →

arxiv 2607.24618 v1 pith:WXLCSH7P submitted 2026-07-27 cs.CR

Stephen Shaffer , Laura Voicu This is my paper · ORCID
classification cs.CR
keywords vulnerabilitymanagementexploitpredictionEPSShazardratesurvivalanalysisBayesianinferencecontroleffectivenessremediationprioritization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Organizations face far more published vulnerabilities than they can fix, and common severity scores do not say how many exploit events to expect on their own assets. This paper offers a local exploit hazard model that takes a global exploit-likelihood score, shrinks it by how well the defender’s controls block the matching attack path, and converts the residual probability into a daily hazard rate. Control effectiveness starts as an expert-pooled probability distribution and is updated with telemetry, simulations, or tests. Hazards then add from single vulnerabilities up to hosts, units, and the whole organization, so candidate fixes can be simulated and ranked by how much total hazard they remove under limited capacity. A sympathetic reader cares because the method answers a practical question—how many exploits should we expect, and which actions cut that number most—without waiting for a full financial-risk model.

What carries the argument

Local exploit hazard: residual, control-adjusted exploit likelihood converted by survival analysis into a daily hazard rate (constant exponential or KEV-calibrated Weibull), then aggregated by summation so actions can be ranked on ΔH_agg.

What would settle it

On a real fleet with known patch outcomes, check whether ranking fixes by projected hazard reduction removes more observed or simulated exploit events per unit effort than volume- or severity-based queues, and whether host-level grouped likelihoods match reality when many flaws share one component.

Watch

Extended reading notes

Core claim

A defender can convert global exploit-likelihood model outputs into organization-local daily exploit hazard by adjusting each score for control bypass probability, mapping residual likelihood to an exponential or age-decaying Weibull hazard, summing those hazards under independence to any asset grouping, and ranking remediation actions by projected aggregate hazard reduction.

Load-bearing premise

The ranking math treats exploits and controls as independent, so probabilities multiply and hazards simply add—even though flaws in the same component are often linked and can badly overstate host risk.

Editorial extensions

If this is right

  • Defenders can report expected exploit counts over any horizon as integrated aggregate hazard, not only ordinal severity lists.
  • Remediation queues can be ordered by hazard removed per unit capacity, so small high-reach fixes can outrank large low-hazard patch batches.
  • Control value becomes measurable as reduction in residual hazard once effectiveness posteriors update from tests and telemetry.
  • Weibull age decay lowers priority on old unpatched flaws relative to fresh ones when the shape fit holds.
  • The same hazard output is positioned as the input to later incident-frequency and financial-loss extensions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If independence fails systematically, organizations will need component- or graph-level grouping before the summed hazard is safe for board-level expected-count claims.
  • The method’s operational bite may show up first as a closed-loop backlog tool—re-simulating ΔH_agg after each change—more than as a one-shot risk number.
  • Calibrating the Weibull shape on broader exploited-vulnerability timing, not only one curated catalog, would be a direct empirical stress test of the decay claim.
  • Once local exploitation telemetry trains the input likelihoods, the same pipeline could compare global versus local ELMs on identical control and aggregation steps.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The manuscript proposes a "local exploit hazard model": a pipeline that takes global exploit-likelihood probabilities (e.g., EPSS 30-day scores), discounts them by locally estimated control-effectiveness rates aligned to CVSS attack vectors (Eq. 2), groups per-vulnerability residuals to the host level via a complement product under independence (Eq. 3), converts the result to a daily hazard via the standard survival-analysis transform −ln(1−P)/t (Eqs. 4–5), optionally replaces the constant exponential hazard with a Weibull hazard whose shape parameter k≈0.605 is fit by MLE to CISA KEV publication-to-listing intervals (Eqs. 6–8), aggregates hazards by summation to arbitrary organizational scopes (Eq. 9), and ranks candidate remediation actions by projected aggregate hazard reduction ΔH_agg (§3.7). Control effectiveness is represented as a Beta distribution seeded by an SME linear opinion pool and updated by Beta-Binomial inference from telemetry, BAS, or penetration testing, with an explicit discussion of the missing-not-at-random bias in log-based observation (§3.1.2). All quantitative exhibits (Figure 1–2 pools, Table 1 ledger on a synthetic ~3,000-host organization, the Kendall-τ ranking-stability experiment) are illustrative or simulation-based; no validation against observed exploitation or incident data is presented.

Significance. If the localization step is sound, the contribution is practically meaningful: a defensible, auditable conversion of EPSS-style scores into organization-specific daily hazard, with honest horizon handling, age-dependent risk decay calibrated on 1,362 real KEV intervals, and an action-ranking procedure defined purely over model inputs. The paper deserves credit for unusual candor about its own weaknesses: it names and quantifies the independence overstatement (~13× in §3.4), flags the per-attempt vs. single-event understatement in §3.2, acknowledges the invalid ordinal arithmetic on Likert weights (§3.1.1), and explicitly calls its own KEV multiplicative weight "not statistically coherent" (§3.3). The survival-analysis machinery (Eqs. 4–8) is textbook and internally consistent, and the Monte Carlo check that the top-5 remediation ranking is stable to posterior uncertainty in CE (τ≈0.94, §3.7) is the right kind of robustness probe. However, the central claim — that multiplying an EPSS score by (1−CE) yields an organization-local exploit likelihood — rests on an unstated assumption about what EPSS probabilities are conditioned on, and the entire quantitative case is synthetic. The gap

major comments (4)
  1. [§3.2, Eq. (2)] §3.2, Eq. (2): the load-bearing localization step EL_ic = EL_i × (1−CE) implicitly assumes the ELM probability is a pre-control attempt likelihood — i.e., the probability that exploitation activity reaches the organization's control layer. But EPSS is trained on observed exploitation across the global population, and that population already deploys EDR, firewalls, WAFs, etc. EPSS scores are therefore marginal over the world's average control posture, not pre-control. For an organization with a roughly typical control stack, multiplying by (1−CE) with CE≈0.6 deflates every hazard by ~2.5×, differentially so for better-defended organizations, and — critically for the paper's operational payoff — double-credits control-deployment actions in ΔH_agg for effectiveness already baked into the input scores. Unlike the independence issue (which the authors quantify), this conditioning question is
  2. [§3.4–3.6, Eqs. (3), (9)] Eqs. (3) and (9): all aggregation and ranking math rests on independence of exploitation events across vulnerabilities and hosts. The authors themselves show (§3.4) this can overstate host-level likelihood by ~13× for correlated flaws in one component, and defer the component-level max fix and graph dependency structure to future work (§5.3–5.4). The deferral is defensible only if the operational claim — the ΔH_agg ranking — is robust to the error. A common multiplicative inflation would preserve ranks, but correlation is not uniform across actions: a patch closing 15 co-located flaws gets ~13× inflated credit while a control upgrade spanning independent components does not, so the ranking itself can be distorted. The authors should either implement the component-max grouping they already describe (it appears cheap: take max EL_ic per component before the complement product) and re-run t
  3. [§3.5, Eqs. (6)–(8)] Eqs. (6)–(8): the Weibull model mixes two time bases. λ_w is derived (Eq. 7) from the ELM probability p, which is a forward-looking 30-day probability conditioned on the vulnerability's current state — and EPSS's features already encode vulnerability age/recency, so some age-decay is arguably already in p. The model then additionally applies an age-since-disclosure decay via h(t). Whether this double-counts age effects, or is coherent because the KEV timing distribution measures a different quantity (cataloging delay of confirmed exploitation, not exploit-attempt intensity), needs explicit argument. Relatedly, the calibration target is publication→KEV-listing intervals, which the authors note is an upper bound on time-to-exploitation and is subject to CISA's federal-priority curation; fitting k on this proxy and then interpreting h(t) as an exploit-attempt hazard conflates detection/cata
  4. [§3.7, Table 1 / validation] The manuscript claims a 'defensible, quantitative basis for prioritization' (Abstract, §3.7), but every quantitative exhibit is synthetic or illustrative: the SME pool (Fig. 1), the posterior convergence (Fig. 2), the ~3,000-host remediation ledger (Table 1), and the ranking-stability Monte Carlo (§3.7). There is no backtest — e.g., applying the pipeline to a historical vulnerability inventory and comparing predicted exploit-event counts or ranking quality against observed exploitation (KEV additions, honeypot data, or the organization's own incident records) against baselines such as raw EPSS ranking, CVSS, or SSVC. Since EPSS-alone ranking is the obvious incumbent and is free, demonstrating that the control-adjusted local model improves prioritization over it is the core empirical burden of the paper. Even a single retrospective case study would move this from a methodology proposal to
minor comments (6)
  1. [§3.3] §3.3: the KEV multiplicative weight is described by the authors as 'not statistically coherent' yet retained with default 1.0. Consider replacing the multiplier with a post-hoc compliance override on the output queue (KEV-listed items flagged/elevated after ranking), which preserves the regulatory function without corrupting the probabilistic semantics of EL_i.
  2. [§3.1.1] §3.1.1: the Likert-multiplier weighting is acknowledged as invalid arithmetic on ordinal values. A cleaner alternative with the same intent is to weight experts by an empirical calibration score or to elicit the weight directly; at minimum, report how sensitive the conservative point estimate is to the weighting scheme.
  3. [§5.1] §5.1: 'Security and Exchange Commission' should read 'Securities and Exchange Commission'.
  4. [§3.5, §3.7] Reproducibility: the KEV timing MLE fit (k=0.605 over 1,362 intervals) and the τ=0.94 ranking-stability experiment are described only in prose. Publishing the fit script, the interval dataset construction rules (the 131+131 exclusions), and the Monte Carlo code would let readers verify the two empirical anchors of the paper.
  5. [§3.2–3.6, Fig. 3] Notation is inconsistent between EL_ic, ELic, and EL_g across §3.2–3.5; t_ELM is introduced for EPSS=30 but the general-ELM case (other horizons, per §5.4) would benefit from a parameter table. Figure 3(b)'s claim that the Weibull aggregate 'falls below the exponential because the organization's vulnerability population is not fresh' should state the assumed age distribution of the population.
  6. [Table 1] Table 1: 'Total (queued cycle) 29.46' sums ΔH_agg across actions, but actions are not independent in their effects (e.g., a Windows cumulative update may close some of the same instances a Chrome update touches is unlikely, but control-tuning actions would interact). A footnote clarifying that the ledger treats action effects additively — and whether the total is realizable — would prevent misreading.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: hazard and ranking are compositional transforms of external ELM scores plus separately elicited CE, not results forced by their own inputs.

full rationale

The derivation chain is self-contained and non-circular. Global ELM probabilities (e.g. EPSS) and KEV catalog timings are external inputs; control-effectiveness posteriors are seeded from SME pools and updated by Beta-Binomial telemetry/BAS/pen-test observations, then applied multiplicatively by attack-vector alignment (Eq. 2). Conversion to daily hazard uses standard survival formulas (exponential Eq. 5; Weibull Eqs. 6–8 with scale tied to the ELM horizon). Aggregation by summation under independence (Eq. 9) and remediation ranking by simulated ΔH_agg are definitional uses of the constructed metric, not predictions that renormalize the fitting target. The Weibull shape k≈0.605 is an MLE calibration on 1,362 CISA KEV time-to-entry intervals and is then used as a modeling choice for age decay—it is ordinary parameter fitting, not a claim that the model predicts the same KEV timings. There are no load-bearing self-citations, uniqueness theorems imported from the authors, or renamed known results presented as derivation. Validity concerns (independence overstatement; whether EPSS is pre-control) are soundness issues outside this circularity pass. Score 0; steps empty.

Assumptions & free parameters 4 free parameters · 7 assumptions · 1 invented entities

The central operational claim rests on standard survival and Bayesian tools plus several domain modeling choices: independence for multiply/add aggregation, attack-vector-aligned multiplicative control bypass, collapsing CE posteriors to a conservative point, optional incoherent KEV weighting, and a Weibull shape fit to curated KEV timing rather than a random sample of first exploitation. No new physical entities; the 'local exploit hazard' is a defined rate, not a postulated substance. Free parameters are few but load-bearing for age decay and prioritization numerics.

free parameters (4)
  • Weibull shape k = k=0.605 (k=0.514 with zero-days shifted)
    Calibrated by MLE on CISA KEV time-to-entry intervals; drives age decay of hazard and can dominate aggregate H_agg vs exponential. Authors recommend sensitivity band 0.5–0.7.
  • KEV multiplicative weight / floor = default 1.0 (operator-chosen)
    Configurable modifier on EL_i for KEV-listed CVEs; default 1.0. Directly changes residual likelihood and ranking despite acknowledged epistemic incoherence.
  • SME Likert expertise multipliers and conservative pool statistic = survey-dependent; min central tendency propagated
    Ordinal Likert weights and choice of minimum central tendency across equal/expertise-weighted mean/median set the CE point estimate until data arrive; authors admit Likert arithmetic is invalid.
  • Control-effectiveness Beta prior (default Beta(1,1) or SME pool) = default Beta(1,1) then SME-fitted Beta
    Prior anchors posteriors against MNAR log inflation; choice materially affects early-deployment rankings when telemetry is sparse.
assumptions (7)
  • domain assumption Exploitation attempts across distinct vulnerability instances on a host are independent, so host likelihood is 1−∏(1−EL_ic) and hazards sum across instances/hosts.
    Invoked in §3.4–3.6 and Eq. 3/9; paper quantifies large overstatement when flaws share a component.
  • domain assumption Aligned controls act independently; residual likelihood multiplies bypass probabilities EL_ic = EL_i × ∏_j(1−CE_j).
    Section 3.2; no interaction or ordered-defense model.
  • ad hoc to paper ELM horizon probability may be treated as a single aggregate event for one-shot control application (vs per-attempt form).
    Explicit modeling choice in §3.2 retained for tractability; authors note it can understate residual likelihood.
  • domain assumption CVSS attack-vector string correctly determines which controls can affect a vulnerability.
    §3.2 attack-vector alignment rule.
  • standard math Standard survival conversions: constant hazard λ=−ln(1−P)/t; Weibull hazard with scale fixed to match ELM-horizon probability.
    Eqs. 4–8; textbook survival analysis.
  • domain assumption Beta-Binomial conjugate updating is an adequate model of control prevention counts from telemetry/BAS/pen tests, with SME prior correcting MNAR detection bias.
    §3.1.2; MNAR issue is discussed but not formally identified beyond prior anchoring.
  • domain assumption CISA KEV addition timing is informative enough to calibrate population exploitation-age decay despite curation and upper-bound-on-first-exploit biases.
    §3.5 Weibull calibration caveats.
invented entities (1)
  • Local exploit hazard model (organization-scoped daily exploit hazard H_agg)
    purpose: Named aggregate rate that localizes ELM output and supports additive rollup and remediation ΔH ranking.
    Not a new physical entity but a defined operational construct; included for ledger completeness because the paper’s contribution is this object’s definition and use.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Modeling Local Exploit Hazard - A Bayesian Framework for Quantifying Exploit Risk and Operational Efficiency." pith.science (2026). https://pith.science/paper/WXLCSH7P

@misc{pith2026260724618,
  author       = {Pith},
  title        = {Pith review of: Modeling Local Exploit Hazard - A Bayesian Framework for Quantifying Exploit Risk and Operational Efficiency},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WXLCSH7P}},
  note         = {Machine review of arXiv:2607.24618}
}
read the original abstract

This paper presents a local exploit hazard model : a Bayesian framework that converts the global probabilities produced by an exploit likelihood model (ELM), such as the Exploit Prediction Scoring System (EPSS), into a daily exploit hazard rate for an organization's own assets. The model measures the exploit-prevention effectiveness of deployed controls as a probability distribution. That distribution is seeded from a subject-matter-expert opinion pool and updated through Beta-Binomial inference from telemetry, breach-and-attack simulation, or penetration testing, then applied to ELM scores by attack-vector alignment. The resulting per-vulnerability exploitation likelihoods are converted into hazard rates using standard survival-analysis techniques, supporting both a constant exponential hazard and a Weibull hazard whose shape parameter, calibrated from Known Exploited Vulnerabilities catalog timing, captures the empirical decay of exploitation risk as a vulnerability ages. Because hazards are additive under independence, per-vulnerability rates aggregate by summation up to host, network, business unit, and organization. Candidate remediation actions are simulated and ranked by projected hazard reduction, giving defenders a defensible, quantitative basis for prioritization under fixed capacity. Future work includes extensions for incident likelihood and financial loss modeling.

Figures

Figures reproduced from arXiv: 2607.24618 by the authors.

Figure 1
Figure 1. Pooling expert control-effectiveness estimates. Linear opinion pool aggregation of eight subject-matter-expert estimates. (a) Per-respondent Beta beliefs recovered from each expert’s elicited median and 90th-percentile pair; line weight encodes self-rated Likert expertise. (b) The equal-weight and expertise-weighted linear pools over the same responses, with the four candidate central tendencies (equal- and expertis… view at source ↗
Figure 2
Figure 2. Bayesian belief convergence. How the shape of a control-effectiveness estimate sharp￾ens as evidence accumulates. (a) Stage 1 is the uninformed Beta(1, 1) prior representing maximum uncertainty; Stage 2 incorporates the SME opinion pool, narrowing the distribution around the experts’ central estimate; and Stage 3 reflects log-based observations, producing a tight posterior whose 90% credible interval spans roughly 0… view at source ↗
Figure 3
Figure 3. Exponential vs. Weibull hazard. Both models on identical inputs. (a) Daily hazard against vulnerability age for a fixed ELic; the exponential model is age-invariant by construction, while the KEV-calibrated Weibull decays. (b) Organizational aggregate Hagg under each model. The Weibull aggregate falls below the exponential because the organization’s vulnerability population is not fresh. before NVD publication). The… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Hazard reduction is not volume. Remediation actions ranked by aggregate daily hazard removed. (a) ∆Hagg per action. (b) ∆Hagg against the number of vulnerability instances each action clears: the OpenSSL upgrade touches fewer instances on fewer hosts than the macOS upd…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 1 linked inside Pith

  1. [1]

    CVE program metrics: 2025 year-end statistics,

    CVE.org, “CVE program metrics: 2025 year-end statistics,” Jan. 2026. [Online]. Available: https://www.cve.org/

    2025

  2. [2]

    Annual CVE data reviews (2020–2025)

    J. Gamblin, “Annual CVE data reviews (2020–2025).” [Online]. Available:https://jerrygam blin.com/2026/01/01/2025-cve-data-review/

    2020

  3. [3]

    CVE Forecast

    J. Gamblin, “CVE Forecast.” [Online]. Available:https://cveforecast.org

  4. [4]

    Vulnerability forecast 2026: The Year Ahead,

    FIRST, “Vulnerability forecast 2026: The Year Ahead,” Feb. 2026. [Online]. Available:https: //www.first.org/blog/20260211-vulnerability-forecast-2026

    arXiv 2026

  5. [5]

    The 2026 Vulnerability Forecast Update: Navigating the AI Epoch,

    J. Gamblin and E. Leverett, “The 2026 Vulnerability Forecast Update: Navigating the AI Epoch,” Jun. 2026. [Online]. Available:https://www.first.org/blog/20260615-vulnerabi lity-forecast-update

    arXiv 2026

  6. [6]

    Prioritization to prediction, vol. 8,

    Cyentia Institute and Kenna Security, “Prioritization to prediction, vol. 8,” 2022

    2022

  7. [7]

    Comparing vulnerability severity and exploits using case-control studies,

    L. Allodi and F. Massacci, “Comparing vulnerability severity and exploits using case-control studies,”ACM Trans. Inf. Syst. Secur., vol. 17, no. 1, 2014

    2014

  8. [8]

    SoK: Quantifying cyber risk,

    D. W. Woods and R. Böhme, “SoK: Quantifying cyber risk,” inProc. 2021 IEEE Symp. Security and Privacy (SP), 2021, pp. 211–228

    2021

Show all 33 references
  1. [9]

    J. P. Klein and M. L. Moeschberger,Survival Analysis: Techniques for Censored and Truncated Data, 2nd ed. New York: Springer, 2003

    2003

  2. [10]

    Rausand and A

    M. Rausand and A. Høyland,System Reliability Theory: Models, Statistical Methods, and Applications, 2nd ed. Hoboken, NJ: Wiley, 2004

    2004

  3. [11]

    N. L. Bowers, H. U. Gerber, J. C. Hickman, D. A. Jones, and C. J. Nesbitt,Actuarial Mathe- matics, 2nd ed. Schaumburg, IL: Society of Actuaries, 1997

    1997

  4. [12]

    Incidence,

    S. Tenny and S. W. Boktor, “Incidence,” inStatPearls. Treasure Island, FL: StatPearls Pub- lishing. [Online]. Available:https://www.ncbi.nlm.nih.gov/books/NBK430746/

  5. [13]

    Cybersecurity insurance: Modeling and pricing,

    M. Xu and L. Hua, “Cybersecurity insurance: Modeling and pricing,” Society of Actuaries, Schaumburg, IL, Mar. 2017. [Online]. Available:https://www.soa.org/globalassets/asset s/files/research/projects/cybersecurity-insurance-report.pdf

    2017

  6. [14]

    D. W. Hubbard and R. Seiersen,How to Measure Anything in Cybersecurity Risk, 2nd ed. Hoboken, NJ: Wiley, 2023

    2023

  7. [15]

    Combining probability distributions from experts in risk analysis,

    R. T. Clemen and R. L. Winkler, “Combining probability distributions from experts in risk analysis,”Risk Analysis, vol. 19, no. 2, pp. 187–203, Apr. 1999

    1999

  8. [16]

    Common Vulnerability Scoring System version 4.0: Specification document,

    FIRST, “Common Vulnerability Scoring System version 4.0: Specification document,” 2023. [Online]. Available:https://www.first.org/cvss/v4.0/specification-document 13

    2023

  9. [17]

    Prioritizing Vulnerability Re- sponse: A Stakeholder-Specific Vulnerability Categorization, Version 2.0

    Carnegie Mellon University Software Engineering Institute, “Prioritizing Vulnerability Re- sponse: A Stakeholder-Specific Vulnerability Categorization, Version 2.0.” [Online]. Available: https://www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeho lder-specifi...

  10. [18]

    Binding Operational Directive 26-04

    CISA, “Binding Operational Directive 26-04.” [Online]. Available:https://www.cisa.gov/n ews-events/directives/bod-26-04-implementation-guidance-prioritizing-securit y-updates-based-risk

  11. [19]

    Exploit Prediction Scoring System (EPSS),

    J. Jacobs, S. Romanosky, B. Edwards, I. Adjerid, and M. Roytman, “Exploit Prediction Scoring System (EPSS),”Digital Threats: Research and Practice, vol. 2, no. 3, pp. 1–17, 2021

    2021

  12. [20]

    Enhancing Vulnerability Priori- tization: Data-Driven Exploit Predictions with Community-Driven Insights,

    J. Jacobs, S. Romanosky, O. Suciu, B. Edwards, and A. Sarabi, “Enhancing Vulnerability Priori- tization: Data-Driven Exploit Predictions with Community-Driven Insights,” arXiv:2302.14172, 2023

    2023 arXiv

  13. [21]

    Known exploited vulnerabilities catalog, BOD 22-01,

    CISA, “Known exploited vulnerabilities catalog, BOD 22-01,” 2022–2026. [Online]. Available: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    2022

  14. [22]

    VulnCheck KEV Catalog

    VulnCheck, “VulnCheck KEV Catalog.” [Online]. Available:https://vulncheck.com/kev

  15. [23]

    Known Exploited Vulnerabilities Catalog

    CIRCL, “Known Exploited Vulnerabilities Catalog.” [Online]. Available:https://vulnerabil ity.circl.lu/known-exploited-vulnerabilities-catalog/

  16. [24]

    European Union Vulnerability Database (EUVD)

    European Union Agency for Cybersecurity (ENISA), “European Union Vulnerability Database (EUVD).” [Online]. Available:https://euvd.enisa.europa.eu/

  17. [25]

    A technique for the measurement of attitudes,

    R. Likert, “A technique for the measurement of attitudes,”Archives of Psychology, vol. 22, no. 140, pp. 5–55, 1932

    1932

  18. [26]

    Ahybridmethodfornonlinearequations,

    M.J.D.Powell, “Ahybridmethodfornonlinearequations,” inNumerical Methods for Nonlinear Algebraic Equations, P. Rabinowitz, Ed. London: Gordon and Breach, 1970, pp. 87–114

    1970

  19. [27]

    Gelman, J

    A. Gelman, J. B. Carlin, H. S. Stern, D. B. Dunson, A. Vehtari, and D. B. Rubin,Bayesian Data Analysis, 3rd ed. Boca Raton, FL: CRC Press, 2013. [Online]. Available:https://site s.stat.columbia.edu/gelman/book/BDA3.pdf

    2013

  20. [28]

    R. J. A. Little and D. B. Rubin,Statistical Analysis with Missing Data, 2nd ed. Hoboken, NJ: Wiley, 2002

    2002

  21. [29]

    A statistical distribution function of wide applicability,

    W. Weibull, “A statistical distribution function of wide applicability,”Journal of Applied Me- chanics, vol. 18, no. 3, pp. 293–297, 1951

    1951

  22. [30]

    Factor Analysis of Information Risk (FAIR) Model, Standard Artifact, Version 3.0,

    FAIR Institute, “Factor Analysis of Information Risk (FAIR) Model, Standard Artifact, Version 3.0,” Jan. 2025

    2025

  23. [31]

    Form 8-K: Current report,

    U.S. Securities and Exchange Commission, “Form 8-K: Current report,” 2023. [Online]. Avail- able:https://www.sec.gov/files/form8-k.pdf

    2023

  24. [32]

    Information risk insights study (IRIS) 2025

    Cyentia Institute, “Information risk insights study (IRIS) 2025.” [Online]. Available:https: //www.cyentia.com/publication/iris2025/

    2025

  25. [33]

    Hype and heavy tails: A closer look at data breaches,

    B. Edwards, S. Hofmeyr, and S. Forrest, “Hype and heavy tails: A closer look at data breaches,” Journal of Cybersecurity, vol. 2, no. 1, pp. 3–14, 2016. 14

    2016

Pith tools

Reviewed July 31, 2026 · model on record in the stance chip above.