Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:40 PM
Dark Reading
Dark Reading
Products and Releases

Vulcan Cyber Research Reveals Most Enterprise Cyber Security Teams Lack the Ability to Remediate Risk

Benchmark study finds most cyber security organizations lack the tooling and resources to remediate risk and deliver enterprise cyber hygiene.

TEL AVIV, Israel — May 12, 2021 — Vulcan Cyber®, developers of the industry’s only risk and vulnerability remediation platform, today released the results of its latest vulnerability remediation maturity research project. A survey of more than 100 enterprise security executives across North America and EMEA found that most enterprise cyber security and vulnerability management organizations lack the ability to drive remediation initiatives, to remediate risk and achieve acceptable levels of cyber hygiene. Vulcan Cyber is using the benchmark data from this research to provide cyber security leaders with a free vulnerability remediation maturity self-assessment service.

Conducted by Pulse, the Vulcan Cyber vulnerability remediation maturity survey examines the maturity of enterprise vulnerability remediation programs while seeking to identify where shortcomings exist within respondents’ ability to remediate risk relative to their cyber hygiene efforts. According to the findings, 56% of organizations lack the ability to remediate vulnerabilities with speed and at the scale necessary to protect business from exploits and hackers. Immature cyber security teams typically react to vulnerabilities on a case-by-case basis. Additionally, nearly 80% of respondents do not have the proper tooling to proactively orchestrate and automate vulnerability remediation.

“Enterprises must work to get ahead of the relentless barrage of known security vulnerabilities that increasingly threaten business. Development, IT operations and security teams should be able to coordinate and measure their efforts to remediate vulnerabilities quickly and at scale,” said Yaniv Bar-Dayan, Vulcan Cyber CEO and co-founder. “To be effective, it takes the right people, processes and tools. If any one is lacking, it is close to impossible to drive meaningful remediation outcomes. It is no small task to get fix done so we are doing all we can to make vulnerability scanning and vulnerability prioritization freely available to all cyber security teams.”

Key findings from the Vulcan Cyber study include:

  • Only 21% of enterprises have the proper tooling to proactively manage and automate vulnerability remediation. While only one-third (34%) of respondents reported having a defined, effective process for detecting and responding to vulnerabilities, one-third (33%) lack an effective or comprehensive process entirely.
  • Forty-four percent of survey respondents only rely on the criticality of a vulnerability and the available bandwidth of IT and security teams to determine how quickly to remediate a vulnerability—and less than one-quarter (21%) are proactively remediating as quickly as possible.
  • Nearly one-third (31%) of respondents admitted their organizations do not prioritize vulnerabilities at all. The most mature organizations use a combination of inputs from CVSS scores, threat intelligence, and risk to business assets to prioritize vulnerabilities, but this was only 26% of enterprises.
  • Forty-six percent of survey respondents either don’t measure vulnerability risk at all, or rely on “gut feel.”

This infographic summary provides a high-level view of the survey benchmark findings.

“As organizations become more mature in their vulnerability remediation efforts, it is possible to become substantially more efficient, while increasing the scale of cyber hygiene coverage,” said Bar-Dayan. “It requires all stakeholders – security, IT operations, engineering, and business unit owners – to align objectives and orchestrate tooling to create optimized and automated remediation workflows. We are working to change the economics of risk operations and vastly improve enterprise cyber hygiene.”

Vulcan Cyber has made it easy for organizations to assess their vulnerability remediation maturity levels using its new security self-assessment tool. For additional guidance on how to benchmark current practices and outcomes against using the Vulcan Vulnerability Remediation Maturity Model, read the Vulcan Cyber eBook titled, The Four Levels of Mature Vulnerability Remediation.

For more information about Vulcan Cyber, please visit https://vulcan.io/ to request a demo, or try Remedy Cloud today. In addition, Vulcan Free is now available as the industry’s only free vulnerability prioritization tool. Apply for Vulcan Free access today.

About Vulcan Cyber
Vulcan Cyber has developed the industry’s first risk and vulnerability remediation platform, built to help businesses reduce cyber risk through measurable cloud and application security. The Vulcan platform orchestrates and tracks the remediation lifecycle from scan to fix by prioritizing vulnerabilities, curating and delivering the best remedies, and automating processes and fixes through the last mile of remediation. Vulcan Cyber helps IT security teams collaborate and “get fix done” at scale. Vulcan Cyber is proud to offer Remedy Cloud and Vulcan Free as freemium SaaS solutions for businesses of all sizes. The unique capability of the Vulcan Cyber platform has garnered Vulcan Cyber recognition as a 2019 Gartner Cool Vendor and as a 2020 RSA Conference Innovation Sandbox finalist. https://vulcan.io

Media contact:
Dex Polizzi
Lumina Communications on behalf of Vulcan Cyber
vulcan at luminapr dot com


Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-15
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why...
PUBLISHED: 2021-06-14
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted request. This vulnerability affects SonicOS Gen5, Gen6, Gen7 platforms, and SonicOSv virtual firewalls.
PUBLISHED: 2021-06-14
magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, an...
PUBLISHED: 2021-06-14
net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.
PUBLISHED: 2021-06-14
Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids ...