In order to augment and scale limited in-house security expertise, many organizations rely on automated security scanning tools to find misconfigurations, services that need to be patched, and web application vulnerabilities. While much research has been done into detecting new types of vulnerabilities and finding known ones more precisely, there has been disappointingly little examination of how successful these techniques are in practice and, more importantly, how effective these tools are in making companies more secure.
We will discuss insights gained from analysing the results of running a commercial security scanner on 100 international companies across 10 industry verticals from Februrary 2014 until May 2015, collectively representing over 900,000 findings. We examine questions such as: what are the common types of vulnerabilities in real companies today? Does it vary by industry? For a given type of vulnerability, how long does it take companies to remediate issues? Does the time to fix depend on one or more of: the type of the vulnerability, its severity, or merely on its solution? Do companies or industries tend to fix the same types of vulnerabilities in a similar time frame or is there significant variation?
We aim to provide industry professionals with objective data against which they can compare their company's performance, and security researchers with insights into impactful areas they can focus on in their future work.