{"href":"http://player.captivate.fm/services/oembed?url=http%3A%2F%2Fplayer.captivate.fm%2Fepisode%2F0d80418d-ac30-4432-a2c7-7ee6d5cd5df7","version":"1.0","provider_name":"Captivate.FM","provider_url":"https://www.captivate.fm","width":600,"height":200,"type":"rich","html":"<iframe style=\"width: 100%; height: 200px;\" title=\"Ep46: Vulnerability Prioritization: Why 98.5% of CVEs Are Never Exploited\" frameborder=\"0\" scrolling=\"no\" allow=\"clipboard-write\" seamless src=\"http://player.captivate.fm/episode/0d80418d-ac30-4432-a2c7-7ee6d5cd5df7\"></iframe>","title":"Ep46: Vulnerability Prioritization: Why 98.5% of CVEs Are Never Exploited","description":"Roughly 98.5% of all known CVEs have never been exploited. We break down a conversation between Jeremiah Grossman and Robert Hansen of Root Evidence, hosted by Raphael Mudge on Down the Rabbit Hole, and what it means for how you prioritize a patch queue: CVSS score vs. exploitation evidence vs. insurance-claims data, CISA's free KEV catalog, and why the vulnerability management industry has no incentive to tell you the truth.","thumbnail_width":300,"thumbnail_height":300,"thumbnail_url":"https://artwork.captivate.fm/6daab296-d019-4be9-bbf4-3e3566f5d395/UatAugnAE7j5mC_O7AskLuwU.png"}