You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<td>Phoenix Security adopts a refined approach to contextual vulnerability management, integrating a sophisticated risk formula that quantifies vulnerabilities on a scale from 0 to 1000. This method encompasses three principal components: base severity, the weighted likelihood of exploitation, and the weighted business impact at the vulnerability level. <br><strong>Base Severity</strong>: Establishes the inherent risk posed by a vulnerability, serving as the foundational risk assessment metric. <br><strong>Weighted Likelihood of Exploitation</strong>: This factor evaluates the probability of a vulnerability being exploited, incorporating contextual elements such as externability, cyber threat intelligence (with the Exploit Prediction Scoring System <abbr title="Exploit Prediction Scoring System">EPSS</abbr> among the key indicators), <abbr title="Cybersecurity & Infrastructure Security Agency">CISA</abbr> Known Exploited Vulnerabilities (<abbr title="Known Exploited Vulnerability">KEV</abbr>), exploit availability, and exploit maturity levels (Proof of Concept, Exploitable, Weaponizable). <br><strong>Weighted Business Impact</strong>: Assesses the potential impact of a vulnerability on business operations, factoring in both a user-assigned impact score (1-10 scale) and financial implications. This dimension does not directly influence the overall risk score through financial impact but provides a comprehensive view of the potential operational disruption. Vulnerabilities are systematically categorized across assets, applications, and environments, enhancing the precision of risk assessment. The likelihood of exploitation is detailed by combining external vulnerability data, threat intelligence, and the presence and maturity of exploits. Business impact evaluation includes user input and financial impact assessments, albeit without affecting the overall risk score.\<abbr title="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> aggregation considers asset criticality, whether an asset is internal or external, the volume of vulnerabilities, and groups them in ranges for effective prioritization and management. <br><br>This structured approach enables Phoenix Security to deliver a nuanced, actionable framework for addressing vulnerabilities in a targeted manner.Details on the risk formula are available here: <a href="https://phoenix.security/phoenix-security-act-on-risk-calculation/">https://phoenix.security/phoenix-security-act-on-risk-calculation/</a> For FAQ: <a href="https://phoenix.security/faqs/">https://phoenix.security/faqs/</a> .</td>
4939
4939
<td>✅</td>
4940
4940
</tr>
4941
+
<tr>
4942
+
<td><strong>Amazon</strong></td>
4943
+
<td>Amazon Inspector offers continuous vulnerability scanning for AWS EC2, ECR, and Lambda resources. Inspector provides findings with <abbr title="Exploit Prediction Scoring System">EPSS</abbr> scores, Common Vulnerability Scoring System (<abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr>) scores, and Common Weakness Enumeration identifiers (<abbr title="CWE Common Weakness Enumeration">CWE</abbr>). Findings are created using intelligence from the <abbr title="Cybersecurity & Infrastructure Security Agency">CISA</abbr> Known Exploited Vulnerabilities (<abbr title="Known Exploited Vulnerability">KEV</abbr>) Catalog and 50+ sources. <a href="https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html">https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html</a> <br> Amazon Inspector also offers stateless scanning in CI/CD workflows. Here, findings are returned as CycloneDX SBOMs containing <abbr title="Exploit Prediction Scoring System">EPSS</abbr> scores, <abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> scores, and CWEs. This functionality can be used with a supported CI/CD plugin <a href="https://docs.aws.amazon.com/inspector/latest/user/scanning-cicd.html#plugin-integration">https://docs.aws.amazon.com/inspector/latest/user/scanning-cicd.html#plugin-integration</a> or with the AWS CLI <a href="https://awscli.amazonaws.com/v2/documentation/api/latest/reference/inspector-scan/scan-sbom.html">https://awscli.amazonaws.com/v2/documentation/api/latest/reference/inspector-scan/scan-sbom.html</a></td>
Copy file name to clipboardExpand all lines: vendors/vendors/index.html
+5Lines changed: 5 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -1479,6 +1479,11 @@ <h1>Vendors</h1>
1479
1479
<td>Phoenix Security adopts a refined approach to contextual vulnerability management, integrating a sophisticated risk formula that quantifies vulnerabilities on a scale from 0 to 1000. This method encompasses three principal components: base severity, the weighted likelihood of exploitation, and the weighted business impact at the vulnerability level. <br><strong>Base Severity</strong>: Establishes the inherent risk posed by a vulnerability, serving as the foundational risk assessment metric. <br><strong>Weighted Likelihood of Exploitation</strong>: This factor evaluates the probability of a vulnerability being exploited, incorporating contextual elements such as externability, cyber threat intelligence (with the Exploit Prediction Scoring System <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> among the key indicators), <abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr> Known Exploited Vulnerabilities (<abbrtitle="Known Exploited Vulnerability">KEV</abbr>), exploit availability, and exploit maturity levels (Proof of Concept, Exploitable, Weaponizable). <br><strong>Weighted Business Impact</strong>: Assesses the potential impact of a vulnerability on business operations, factoring in both a user-assigned impact score (1-10 scale) and financial implications. This dimension does not directly influence the overall risk score through financial impact but provides a comprehensive view of the potential operational disruption. Vulnerabilities are systematically categorized across assets, applications, and environments, enhancing the precision of risk assessment. The likelihood of exploitation is detailed by combining external vulnerability data, threat intelligence, and the presence and maturity of exploits. Business impact evaluation includes user input and financial impact assessments, albeit without affecting the overall risk score.\<abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> aggregation considers asset criticality, whether an asset is internal or external, the volume of vulnerabilities, and groups them in ranges for effective prioritization and management. <br><br>This structured approach enables Phoenix Security to deliver a nuanced, actionable framework for addressing vulnerabilities in a targeted manner.Details on the risk formula are available here: <ahref="https://phoenix.security/phoenix-security-act-on-risk-calculation/">https://phoenix.security/phoenix-security-act-on-risk-calculation/</a> For FAQ: <ahref="https://phoenix.security/faqs/">https://phoenix.security/faqs/</a> .</td>
1480
1480
<td>✅</td>
1481
1481
</tr>
1482
+
<tr>
1483
+
<td><strong>Amazon</strong></td>
1484
+
<td>Amazon Inspector offers continuous vulnerability scanning for AWS EC2, ECR, and Lambda resources. Inspector provides findings with <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> scores, Common Vulnerability Scoring System (<abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr>) scores, and Common Weakness Enumeration identifiers (<abbrtitle="CWE Common Weakness Enumeration">CWE</abbr>). Findings are created using intelligence from the <abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr> Known Exploited Vulnerabilities (<abbrtitle="Known Exploited Vulnerability">KEV</abbr>) Catalog and 50+ sources. <ahref="https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html">https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html</a><br> Amazon Inspector also offers stateless scanning in CI/CD workflows. Here, findings are returned as CycloneDX SBOMs containing <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> scores, <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> scores, and CWEs. This functionality can be used with a supported CI/CD plugin <ahref="https://docs.aws.amazon.com/inspector/latest/user/scanning-cicd.html#plugin-integration">https://docs.aws.amazon.com/inspector/latest/user/scanning-cicd.html#plugin-integration</a> or with the AWS CLI <ahref="https://awscli.amazonaws.com/v2/documentation/api/latest/reference/inspector-scan/scan-sbom.html">https://awscli.amazonaws.com/v2/documentation/api/latest/reference/inspector-scan/scan-sbom.html</a></td>
0 commit comments