Как понять, что реально атакуют, что чинить первым и где искать следы компрометации

Webinar Focus

The webinar explains how security teams should prioritize vulnerabilities and conduct incident investigations under constant time and resource pressure. Instead of treating vulnerability management as “just a scanner” that produces endless finding lists, the speakers advocate a risk-driven, continuously updated process that connects vulnerability data to real attack context—enabling faster decisions about what to fix first.

Core Arguments and Analysis

1) The real problem is prioritization, not vulnerability volume

• Modern environments generate constant alerts and new exposures, so the key question becomes: Which vulnerabilities are truly dangerous right now, on which assets, and what should be fixed first?

• A traditional model (periodic audits/pen tests every 6–12 months) is presented as insufficient because infrastructure changes can turn a previously “safe” issue into a near-term threat—such as when:

  • new services are deployed,
  • exposed ports change,
  • packages are updated,
  • public exploits become available.
• The “mature” approach emphasizes:
  • continuous self-testing,
  • continuous asset state understanding, and
  • prioritization based on real risk.

2) Incident response begins with suspicion and context building

• An incident doesn’t always mean a confirmed breach—it may start from suspicious signals.
• Investigation follows structured logic:
  1. Identify suspicious events (detections, anomalies, errors, unusual connections)
  2. Enrich context using dashboards and asset/perimeter location data
  3. Test attack hypotheses by correlating observed behavior with potential vulnerabilities
  4. Determine affected scope (often multiple replicated assets, not just one node)
  5. Prioritize actions (internet-facing assets, confirmed exploitability, business-critical services, high exploitation likelihood, attack indicators)
  6. React/mitigate and verify fixes

3) Perimeter protections (WAF/VAS/etc.) are signals, not conclusions

• If a perimeter defense blocks something, it is a starting point for investigation—not proof the issue is resolved.
• Attackers can potentially bypass or adapt (including changing payloads).
• Coverage can be incomplete (e.g., internal services reachable despite external protections).
• Teams should validate backend responses, logs, server/network state, and configuration/hardening status.

4) CVSS alone doesn’t answer “what to fix first”; add exploitation likelihood and asset context

• CVSS is positioned as useful for technical severity, but it doesn’t fully answer whether the flaw will be exploited against your assets now.
• The webinar stresses enriching priority signals with:
  • EPSS (likelihood of exploitation in the wild)
  • exploit availability / “public exploit” indicators
  • asset exposure/location (internet-facing vs internal)
  • business criticality and attack surface
  • attack indicators and confirmation status
• Example logic: a lower-CVSS issue with higher EPSS/exploitation likelihood and easier reach can outrank a higher-CVSS issue.

5) Reactive vulnerability processes are expensive and dangerous

• Without a repeating process and measurable reporting, teams respond late—often manually piecing context across many tools.
• Reactive work can cause:
  • time and money loss,
  • reduced trust,
  • drained team resources,
  • risks to business continuity.
• The speakers emphasize:
  • repeatable routines,
  • dashboards/metrics,
  • runbooks/scripts to assemble a “single picture,”
  • clear responsibility alignment with management.

Product Demonstration (Alpha Systems / Alpha Sense)

The presenters demonstrate the platform as an impact assessment / vulnerability lifecycle and prioritization system, not merely a scanner.

“Sybiot Space” (late September release)

• Claims to combine:
  • Blackbox audits
  • iBox audits
  • Whitebox checks
• Includes external/internal attack surface assessment.
• Links vulnerabilities to assets/services/context, generating risk indices using:
  • CVSS + EPSS + exploitability/exploitation potential
• Provides:
  • a ticketing workflow
  • targeted retesting (verify whether a specific vulnerability on a specific host is fixed without running a full scan)

Dashboards and reporting shown

• Prioritization views (e.g., CVSS + EPSS/exploitation indicators + asset type)
• Host “briefs”
• Remediation recommendations for IT teams, including consolidated mass-update guidance
• Delta reports to show improvement/deterioration over time

Demonstration examples included

• An asset where an EPSS-ranked vulnerability ties to exploitability and affects many hosts—driving prioritized remediation and ticket assignment
• Cases where web exposure and WAF misses increase risk
• Configuration/compliance audit outputs (e.g., Windows domain policy compliance with remediation guidance)

Roadmap

Planned improvements mentioned:

• automatic vulnerability triage
• additional analytics dashboards (including VM and risk assessment views)
• auditing configuration of network equipment:
  • starting with perimeter NGFW/VPN
  • then expanding to switches (e.g., Cisco/MikroTik)
• expanded compliance validations:
  • PCI DSS v4 support planned for release by November (possibly earlier)

Key Q&A Points (from the Webinar)

• Vulnerability/exploit knowledge updates can be online or offline via an expert service delivery mechanism.
• Exploit data is described as an integrated product part, not a separately paid add-on.
• The system supports marking vulnerabilities as accepted/not relevant.
• If compensating controls prevent detection but the vulnerable software isn’t actually patched, the system will show it as not detectable, not fully “fixed” with full confirmation.
• Reports can be structured around remediation actions/version upgrades, distributing recommendations across many hosts.
• Scanning modes:
  • Blackbox without access credentials
  • Whitebox with credentials (supporting login/password and keys)
• Typical users:
  • SOC/CERT teams (CISA)
  • IT teams when vulnerability management is assigned to them

Presenters / Contributors

• Igor Smirnov — Founder & CEO, Alpha Systems
• Rustam Agayev — speaker (incident response, prioritization approach)
• Marina — speaker (product demonstration and methodology)
• Dmitry Nelyubov — Datalog (system integration partner; webinar close and Q&A support)