Threat Intelligence and Vulnerability Management
This domain tests prioritisation: turning scanner output and adversary knowledge into a defensible remediation order, then proving the order worked.
Core rules and concepts
- Asset inventory and ownership come first; unmanaged assets are invisible risk. Scans must be authenticated to read installed packages and configuration.
- Identification methods: vulnerability scanning, configuration assessment, penetration testing (exploitation, not enumeration), bug bounty, CVE and NVD data, CWE for weakness classes.
- CVSS produces a base score for inherent severity, modified by temporal (exploit maturity, remediation level) and environmental metrics (asset criticality, mitigations). CVSS is not risk by itself.
- EPSS estimates the probability of exploitation in the next 30 days; the CISA KEV catalogue lists vulnerabilities exploited in the wild. Internet exposure, data sensitivity and business criticality complete the picture.
- Remediation options: patch, upgrade, configuration change, compensating control, isolate, or accept with approval and an expiry date.
- Intelligence levels: strategic (trends for leadership), operational (campaigns and actor intent), tactical (TTPs mapped to ATT&CK), technical (indicators such as hashes, IPs, domains).
- Pyramid of Pain: indicators are cheap for an adversary to change; TTPs are expensive. Detections should emphasise behaviour.
- Sharing uses STIX for structure and TAXII for transport; respect TLP markings.
Worked example
Two findings land. A is CVSS 9.8 on an internal-only test server with no KEV listing and no EPSS signal. B is CVSS 7.2 on an internet-facing VPN appliance, listed in KEV, with EPSS 0.94. B is remediated first: it is being exploited now, it is reachable, and it is a gateway into the estate. A goes into the normal patch window with a compensating host firewall rule and a documented risk acceptance carrying an expiry date. The graded reasoning is exposure, exploitation evidence and blast radius - not the raw score.
Traps that cost marks
- Ranking work purely by CVSS base score.
- Treating a scan report as a complete asset inventory.
- Confusing penetration testing with vulnerability scanning.
- Building detections only on indicators, so a single hash change defeats them.