Black Hat USA 2025 | Vulnerability Haruspicy: Picking Out Risk Signals From Scoring System Entrails

Why It Matters

Understanding the true risk behind vulnerability scores prevents wasted effort on low‑impact bugs and ensures resources focus on threats most likely to be exploited.

Key Takeaways

• CVSS scores cluster around 7, rarely low or extreme high.
• Vector components, not just score, reveal true vulnerability risk.
• EPSS predicts ~10,000 CVEs likely exploited monthly worldwide.
• New scoring systems (Pipeline VSS, AI VSS) extend CVSS concepts.
• Relying solely on CVSS thresholds can misguide risk mitigation strategies.

Summary

The talk at Black Hat USA 2025 explored the limits of traditional vulnerability scoring, focusing on CVSS, the emerging EPSS exploit‑prediction model, and newer frameworks such as Pipeline VSS and AI‑VSS. Todd used the ancient haruspex analogy to illustrate how analysts often read omens from raw data, sometimes over‑interpreting statistical noise.

He highlighted that CVSS scores consistently gravitate around the 7‑point range, forming a fractal‑like distribution across days, months, and years. The vector string—access vector, complexity, privileges, user interaction, scope, and impact—contains the actionable insight, while the aggregate number masks nuance. EPSS, built on machine‑learning feeds, now estimates roughly ten thousand CVEs could be exploited within the next thirty days, far exceeding the few thousand actively exploited bugs tracked by platforms like SYSV and VulnDB.

Concrete examples included a Red Hat GRUB bug that only matters if a logged‑in user manipulates the bootloader, and the observation that many high CVSS scores arise from network‑accessible, low‑privilege vectors that are less useful to attackers. He also introduced Pipeline VSS, which tailors attack vectors to code‑repository exposure, and AI‑VSS, which adds a societal‑impact dimension for machine‑learning models.

The implication is clear: security teams should move beyond blanket CVSS thresholds, incorporate vector analysis, and blend EPSS probabilities into patch‑prioritization. Doing so aligns remediation effort with real‑world exploitation risk and prepares organizations for the evolving landscape of AI‑driven vulnerabilities.

Original Description

Vulnerability scoring is supposed to bring order to the chaos of risk management, but in practice, it can feel more like reading tarot cards or poking at entrails than applying science. CVSS performs monkey math to force fractal bell curves, EPSS tries to predict exploitation with statistical black magicks, and SSVC ditches math entirely in favor of structured gut feelings.

Meanwhile, defenders mix and match shortcuts — KEV lists, vendor advisories, and lived experience — to separate the truly urgent from the merely annoying. But are we actually making better risk decisions, or just using these frameworks to justify what we were going to do anyway?

This talk will dig into the strengths, weaknesses, and absurdities of CVSS, EPSS, and SSVC, comparing them to the reality of how security teams actually handle vulnerabilities. This talk will explore where these models help, where they mislead, and whether any of them are meaningfully better than rolling a D20 saving throw vs exploitation. Expect debate, disagreements, and plenty of astrology jokes.

By:

Tod Beardsley | VP of Security Research, runZero

Presentation Materials Available at:

https://blackhat.com/us-25/briefings/schedule/?#vulnerability-haruspicy-picking-out-risk-signals-from-scoring-system-entrails-46326