Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free Trial
Derek Fisher, Director of the Cyber Defense and Information Assurance program at Temple University, said Black Kite’s findings back up what most security teams realized years ago.
“There is a lot of noise in vulnerability management. There has been a continuing effort to determine reachability or exploitability when new findings are discovered, to reduce the burden on security teams that have limited time and resources.”
—Derek Fisher
Roger Grimes, a CISO advisor at KnowBe4, said it isn’t news that less than 1% of reported CVEs are ever used by any real-world criminal against any real-world organization. “It has always been that way,” he said.
“Only a few dozen account for most of the real-world exploits. What that fact tells me is that defenders need to concentrate on the exploits most likely to be used against them. CISA’s Known Exploited Vulnerability Catalog [KEV] list is a good place to start.”
—Roger Grimes
However, Brian English, product security lead at SAS, countered that for organizations managing large enterprise environments, it’s often more efficient, and lower risk, to remediate known vulnerabilities than to spend excessive time trying to determine theoretical exploitability.
“From a product security perspective, it is often safer and more responsible to address known vulnerabilities than to assume they pose no practical risk.”
—Brian English
But he does agree that exploitability analysis can help teams prioritize limited resources and avoid treating every CVE as equally urgent. Just don’t rely solely on tools such as software composition analysis (SCA) and the detection and patching of CVEs, he said, because that can provide a false sense of security.
The Black Kite report also noted that AI is widening the gap between organizations that can afford its advanced security capabilities and those that can’t. “While resource gaps have always existed, AI makes the divide exponentially faster and more concentrated,” Black Kite’s Dikbiyik said.
Anthropic’s Claude Mythos, for example, offers the opportunity to cut vulnerability detection time from 197 days to just 14, but “midmarket software publishers and open-source projects simply cannot afford these enterprise-grade AI defenses,” Dikbiyik said — which is putting them at even greater risk.
“Attackers are adapting to hardened enterprise perimeters by aggressively shifting their focus to these Tier 2 softer targets, meaning risk is migrating directly into the dependencies that large enterprises rely on.”
—Ferhat Dikbiyik
The report reinforces what a soft spot software dependencies are, especially with open-source components. Dikbiyik stressed that 82% of company-to-CVE matches involve vulnerabilities from outside the top 20 vendors.
“For software security teams, this means you cannot secure your perimeter just by monitoring a handful of big tech providers. You need continuous, automated visibility across your entire fragmented vendor ecosystem, because your risk often begins long before a commercial product is ever deployed.”
—Ferhat Dikbiyik
JPMorgan’s Fisher said software security teams have been aware for years that open-source security vulnerabilities are a big problem and have largely deployed the tools such as SCA that can spot them.
“However, these teams do not need more ways to find vulnerabilities in dependencies. They need practical ways to identify vulnerabilities that have impact through exploitability metrics like CISA KEV, EPSS, or OSINT to confirm discoverability and visibility.”
—Derek Fisher
Dikbiyik illustrated the time crunch facing supply chain security defenders: “The median time from an attacker gaining initial access to handing it off to a secondary threat actor, like a ransomware cartel, has plummeted from over eight hours in 2022 to an astonishing 22 seconds.”
“When you combine that hand-off speed with the seven-day exploitation window, the reality cannot be clearer: Once a vendor in your supply chain is compromised, escalation is practically instantaneous.”
—Ferhat Dikbiyik
All of this is happening while the next generation of frontier AI such as Claude Mythos is poised to turn the CVE noise up to 11. But maybe it’s the signal that really matters.
The problem with CVE-centric security isn't that patching known vulnerabilities is wrong — it is necessary, and SAS's English is right that for large enterprises, blanket remediation can be more operationally practical than case-by-case exploitability analysis. But it is incomplete. And the incompleteness is growing more costly as attackers increasingly route around the vulnerability disclosure process entirely.
Supply chain attacks are the clearest illustration of this gap. On June 1, ReversingLabs researchers disclosed that an attacker published malicious versions of 31 packages in the @redhat-cloud-services npm scope in a 72-second scripted batch push. The payload — a three-layer obfuscated credential stealer targeting AWS, Azure, Google Cloud, HashiCorp Vault, GitHub, and npm credentials — began executing the moment any developer ran npm install. No CVE was assigned. No CVSS score was published. No EPSS prediction was generated. The threat was live and credential-harvesting in developer build environments before any vulnerability scanner had anything to scan.
This is the category of threat that vulnerability prioritization frameworks — however sophisticated — cannot address. They are built around disclosed flaws, not injected malware. The SolarWinds, 3CX, and XZ Utils attacks followed the same pattern: the compromise didn't exploit a known vulnerability; it introduced malicious code directly into the software itself.
AppSec teams need a detection layer that catches what vulnerability scanners miss: malware injected into packages before publication, software tampering after build, exposed secrets baked into binaries, and backdoor code introduced through compromised open-source dependencies. Binary analysis addresses this directly — by examining the final, assembled artifact for behavioral indicators of malicious activity, rather than checking it against a list of known flaws.
RL's Spectra Assure Community monitors more than 6 million open-source packages continuously for exactly these indicators. When the @redhat-cloud-services attack landed, behavioral analysis flagged the malicious preinstall execution, dynamic code evaluation, and binary-to-string obfuscation patterns uniformly across all affected packages — before the malicious versions were removed from npm, and before any CVE assignment was possible.
The 58 exploitable vulnerabilities in Black Kite's report are worth patching. But the next supply chain attack isn't going to arrive as CVE number 48,001.
Learn how RL's free Spectra Assure Community monitors open-source packages across npm, PyPI, NuGet, and more for the threats that don't show up in a vulnerability database.
The annual cybersecurity conference focused on frontier AI agents — and what they mean for cyber. Here are three key takeaways.
Researchers built a worm that reasons about hosts it infects, and the open-weight models powering it sit outside AI-provider safety controls.
While prompt injection and data disclosure remain concerns, excessive agency climbed the list — not surprising with recent security incidents.