Exploit Intelligence: It’s Not Just for Offensive Security Pros Anymore

My cybersecurity career spans a little over 18 years with over half spent in offensive security, working as a pentester and red team operator. During my offensive security career, I have seen the use of pentesting and red teaming grow. These are no longer mysterious occupations that are virtually unknown. Organizations are seeing the value of pentests to improve their security posture. In some cases it is just used for compliance, which can impose restrictions on truly utilizing offensive security to its full potential, but I am going to get off my soapbox for now and save that discussion for another day. Today we are going to discuss exploit intelligence. 

Offensive security professionals use exploits (i.e., well crafted code, commands, data, etc. that can leverage a vulnerability) during their assessments for exploitable vulnerabilities that they discover. There are popular exploit databases or repositories that are used to download the latest exploits, as well as exploitation tools such as Metasploit, that practitioners and threat actors use to compromise their targets. 

Offensive security professionals also use the same techniques and tools that threat actors use to get a more holistic view of the security posture of a target, or organization as whole. The exploit databases have mainly been a tool for offensive security professionals, but the ability to understand threats goes beyond the offensive team and is needed by the defenders. Defenders are better equipped to protect against potential threats when they understand the attack vectors available to attackers. While they can educate themselves on offensive security, it already takes much of their time just staying current with defensive tools and strategies. 

This mindset of defenders learning the offensive arts is evolving with resources such as MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) available to help understand TTPs (Tactics, Techniques, and Procedures) used by threat actors. Equipping defenders with exploit intelligence is a way we can help defenders level-up in a shorter period of time and learn the offensive security side of things. 

As a further evolution of resources for defenders, CyCognito has introduced Exploit Intelligence as part of the CyCognito platform. This set of exploit intelligence includes information on emerging threats and the exploits that affect externally exposed assets, such as the associated CVEs, exploits, as well as the step-by-step details on how to safely exploit the vulnerable asset. This helps prioritize what to remediate first based on the real risk of the vulnerability and the security team’s validation and confidence that the organization is at risk. Exploit Intelligence and the CyCognito platform as a whole helps optimize EASM (External Attack Surface Management) efforts allowing security staff to spend more time remediating and improving your organization’s security posture.