In this episode, I sit down with Jeremiah Grossman, CEO of Root Evidence, to dig into the Vulnpocalypse narrative and what the exploitation and insurance loss data actually show.
Jeremiah is an industry OG whose work I’ve followed for a long time, and we share an affinity for Jiu Jitsu. He got his start at Yahoo, founded WhiteHat Security, which he says helped give birth to the AppSec industry, and later worked at SentinelOne and at Tenable after it acquired his attack surface management company, Bit Discovery.
With Root Evidence he is going after vulnerability management, a space he calls old and stale, because in his words that’s where the bad guys moved to.
We start with Root Evidence’s Vulnpocalypse Report, which found that only 3,769 of the 253,912 CVEs published from January 2018 through mid July 2026 had confirmed exploitation in the wild, or 1.48%. Jeremiah explains why he built it on VulnCheck KEV as public data anyone can replicate, and why new KEVs per month and the time from patch to exploitation both looked flat.
From there we get into his defender window research, which found that attackers who exploited n-days in 2026 waited a median of 116 days after the patch, up from 24 days in 2018. We also cover how his bottom up, loss first approach differs from Sergej Epp’s Zero Day Clock, and why the two of them can look at the same data and reach very different conclusions.
The heart of the conversation is efficacy, and Jeremiah says the cyber insurance claims data he sees ties only about 600 CVEs to financial loss, and he asks where the actuarial data is for any security control we deploy.
We close on warranties and liability, the missing catastrophe database for cyber, why “identity theft” is the wrong term, and what it would take for him to change his mind on the Vulnpocalypse.
We recorded this conversation in mid October, before PHP2Shell and the “Black October” label took over the feeds, and I covered that stretch in From Vulnpocalypse to Breachpocalypse?. His “no spike” read on the claims data is worth holding up against what came next.
Prefer to listen?
Please be sure to subscribe and leave a rating/review, as it truly helps the show!
We discuss:
Jeremiah’s path from Yahoo and WhiteHat Security to SentinelOne, Bit Discovery and Root Evidence
Why vulnerability management is cool again, and why attackers moved back to that lane
The Vulnpocalypse Report, the 1.48% of CVEs exploited since 2018, and VulnCheck KEV as a public ground truth
Anton Chuvakin’s test for a real Vulnpocalypse, meaning more exploitation and more breaches rather than more CVEs
Jerry Gamblin’s “rain versus flood” framing from FIRST, and the AI head fake
Why the adversary only has to exploit one to two percent of CVEs to stay the number one attack vector
The 600 CVEs tied to financial loss across roughly 20% of the world’s cyber insurance claims
Whether claims data is a lagging indicator, and why Jeremiah sees steady state with no spike
The defender window, the 116 day median wait after a patch, and his theories on why attackers are slower
How his bottom up loss approach differs from Sergej Epp’s Zero Day Clock
Why insurers write policies for companies deep in vulnerabilities, and what they know about which controls work
Ross Haleliuk’s market for silver bullets, and a $250 billion industry where everyone still gets hacked
Consensus versus efficacy in frameworks and best practices
The missing negative feedback loop for security products that do not work
Tool sprawl, shelfware, and product warranties from SentinelOne to Root Evidence
Software liability, aviation and auto safety standards, and the missing catastrophe database for cyber
Kelly Shortridge’s Markets DGAF About Cybersecurity, and why “identity theft” transfers victimhood to consumers
What it would take for Jeremiah to change his mind on the Vulnpocalypse
Key Takeaways
One to two percent is enough
“The adversary, to be the number one attack vector, only has to exploit between one and two percent of all CVEs. That’s a giant fail for this entire space.”
“If we were doing our job well and patching those, the ones that matter, they would be forced to innovate and then expand the number of vulnerabilities or move to a different lane. We haven’t done that. So we’re not fixing the right [vulnerabilities] in the right order.”
Jeremiah’s “giant fail” line hit home for me, since I wrote a book on vulnerability management back when the industry treated it as crusty spreadsheets and scans that only practitioners cared about. If attackers can stay the leading vector on one or two percent of CVEs, the failure sits squarely in how we prioritize.
The volume pressure is real, and I walked through it in AI Just Broke Vulnerability Management, where Glasswing’s 26,153 findings had produced 202 fixes and FIRST is forecasting 66,000 to 68,000 CVEs for 2026. No team patches a backlog that size in full, so knowing which narrow slice attackers actually use is what decides whether a program works.
600 CVEs and the loss data
“I get CVE data directly from the cyber insurance carriers, the ones that get financial loss. My list is only 600. I can only find 600 CVEs from about 20% of the world’s claims that lead to financial loss. How about we fix those first?”
“There’s no spike. It’s steady state. So one way to look at it is the adversary might be using AI to carry out the exact same attacks at the same rate and the same volume. They’re just using AI tooling to do it.”
Pressing him on whether claims data is a lagging indicator got a straight answer, and he called it “a completely fair critique,” which is the kind of candor I wish we saw more often from people holding a unique dataset. I’ve already made the case in From Vulnpocalypse to Breachpocalypse? that we can’t wait for losses to show up in the actuarial data before acting, so I won’t rehash it here.
Where his list earns its keep is on the defender side of the ledger. If roughly 600 CVEs account for the loss he can see across about 20% of the world’s claims, every security team should know whether any of them are sitting unpatched in its environment today, and the next claims cycle will show whether that list starts to grow.
The defender window
“From the moment a patch drops to when it’s exploited. That was fairly constant. It was like in an area of months, certainly not days or minutes.”
“I wanna come from bottom up that go these are the ones that cause loss and come up that way. Because all these other measurements that are out there, you measure them, they might correlate to things, but you don’t know if that’s causality or anything.”
A frontier lab used the same phrase to argue the window is closing and it’s almost too late, so seeing Root Evidence’s median wait stretch from 24 days in 2018 to 116 days in 2026 is a useful corrective. Both pictures can hold at once, and in The Zero Day Clock Stopped Ticking I argued that the N hour exploitation window and the N year backlog are the same problem viewed from two ends.
Part of the gap comes down to definitions, since Jeremiah measures from patch to exploit, while Sergej’s original time to exploit metric ran from publication, which I first dug into with him in Before the Breach, and Jeremiah lays out his own method in The Defender Window Is Longer Than You Think.
Consensus is not efficacy
“Where is all the actuarial data for any security control we have there for anything? Does anybody have any idea if it actually works?”
“We have a whole industry of guessing and consensus. I do not want to be part of this any longer. I’m going after efficacy data.”
“What are these best practices? This is not efficacy. This is consensus.”
Much of my career has been in federal and defense environments working through NIST RMF and FedRAMP, and as I said on the show, we don’t know what actually works across that acronym soup of SOC 2, HIPAA, HITRUST and the rest. Jeremiah’s description of consensus being written down until it becomes canon matches how a lot of those control catalogs feel from the inside.
Ross Haleliuk makes a related point in Cybersecurity is not a market for lemons. It is a market for silver bullets., where vendors sell products they can’t prove work to buyers who can’t tell either. Layer financial incentives on top and you get an industry that monetizes the symptoms rather than addressing the root cause, and loss data from the carriers is one of the few ways I see to break that cycle.
No negative feedback loop
“I asked them, why don’t you tell your customers where they’re wasting money? ... And they tell me two things. One is they don’t want the liability, and two is that’s not their business. They do not care. They care you do these five things. After that you can waste all the money you want.”
“Right now the interest of the practitioner that bought the product is not in line with the business or in line with the vendor. That’s the problem right there.”
“Patch this or we sacrifice five million dollars in protection” is a sentence a business owner acts on in a way a CVSS 9 rarely manages. In the large federal and commercial enterprises I’ve worked in, the cost of dozens of untuned tools running as shelfware never landed on anyone in a position to fix it, and a warranty puts that cost on the vendor making the claim.
My time at CISA overlapped with Jen Easterly’s push for Secure by Design and software liability, which got real traction in the National Cybersecurity Strategy before today’s deregulatory mood set in. Jeremiah’s view that liability is one of the things that corrects misaligned incentives is the same argument, made by a vendor willing to put its own money behind it.
The catastrophe database
“Please tell me where the catastrophe database is for cyber where I can learn stuff from. It doesn’t exist.”
“The word identity theft was devised to transfer victimship to you and me. This we cannot allow.”
Kelly Shortridge showed in Markets DGAF About Cybersecurity that share prices bounce back quickly after a breach, and I told Jeremiah I think it will take a cyber physical incident to wake people up. I hate that answer given how dependent society is on technology, and his history of aviation and auto safety, where standards followed catastrophes and the crash data behind them, points the same way.
His identity theft example belongs in the same conversation, because calling it loan fraud would make the bank the victim, while the current term moves the loss onto consumers who could never have prevented it.
Just data
“Just data. I track the data. It’s just data. I don’t have a religious statement on this. If AI is the problem, AI is the problem. If it’s not, it’s not.”
“If we see a huge uptick, something caused it, probably will be AI. But I don’t have a narrative on here. I don’t have a dog in this fight.”
Super pragmatic is how I described this approach on the show, and Jeremiah has been clear that if the uptick comes and AI caused it, he will say so. Holding a position loosely and letting the loss and exploitation data move it is the standard I want for everyone in this debate, including me.
I also like that Gadi Evron put him and Sergej on a formal debate stage. Most industry panels end with everyone nodding along, and two people who look at the same data and reach different conclusions will teach the audience more than another round of agreement.
Thanks again to Jeremiah for joining me, since we could have gone much deeper on every one of these topics. He and Sergej were paired for a formal “Where is the Vulnpocalypse?” debate at [un]prompted in San Francisco at the end of October, and both are on the live debate panel at the SANS AI Cybersecurity Summit in Arlington on Nov 3, moderated by Ciaran Martin, who joined me on the show last week.
Jeremiah has more Root Evidence reports in the works, and you can follow him and the team on LinkedIn and at rootevidence.com.
Jeremiah Grossman
Root Evidence | Root Evidence on LinkedIn
The Defender Window Is Longer Than You Think
Timestamps
0:00 Cold open
1:18 Welcome and Jeremiah’s background
2:12 Why vulnerability management, and why now
3:06 The Vulnpocalypse narrative and the 1.48% figure
4:04 Anton Chuvakin’s test and building the dataset on VulnCheck KEV
5:39 Rain versus flood and the AI head fake
7:07 600 CVEs tied to financial loss
7:49 Is loss data a lagging indicator?
8:59 The defender window
11:04 The Zero Day Clock and Sergej Epp
12:08 What insurers know about security controls
14:00 A market for silver bullets
14:45 A $250 billion industry where everyone gets hacked
16:14 Can we measure controls rigorously?
17:20 The missing negative feedback loop
18:00 Tool sprawl and shelfware
18:33 Warranties and liability
19:52 Software liability and the catastrophe database
22:05 Markets, identity theft and liability transfer
23:58 What would change his mind
25:17 Where to find Jeremiah and the debates with Sergej
