Mind the Gap: How Existing Vulnerability Frameworks Can Leave an Organization Exposed

This is the second of a four-part series examining the period of time between when a vulnerability is first discovered and when it is fully disclosed on the National Vulnerability Database. In this installment, we explore how common industry frameworks leave security teams with blind spots — and discuss how Tenable can help.

Knowledge rests not upon truth alone, but upon error also.

—Carl Jung

Each year, cybersecurity teams around the world face an onslaught of new vulnerability disclosures affecting the software and systems in use in their organizations. In 2022 alone, more than 25,000 vulnerabilities were disclosed, nearly a 20% increase over the prior year.

The common frameworks organizations rely upon to evaluate vulnerabilities and prioritize which ones to fix first have become de facto standards. But they also leave security professionals with significant blind spots that serve to increase risk.

In this blog, we examine one of those blind spots: the gap in time between when a vulnerability is first discovered and when it is fully disclosed on the National Vulnerability Database (NVD). Of the 25,000+ vulnerabilities discovered last year, 295 were observed to be exploitable before they were fully disclosed on NVD.

Why is this a concern? Because busy cybersecurity professionals rely on those full NVD disclosures to make their remediation decisions. But attackers don’t wait. They’re ready to pounce as soon as a vulnerability is first discovered, leaving organizations with security gaps that can range from mere days to several months.

We believe these findings offer the valuable context that cybersecurity practitioners need to evolve their vulnerability management practices to embrace a risk-informed view of the expanding attack surface. This is the first step in the journey toward embracing a full exposure management program.

Glossary of terms

22 years of Tenable plugin coverage ahead of NVD

We analyzed historical data to show the full scope of the gap and how it affects common software in use at many organizations. Between Jan. 1, 2000, and Dec. 31, 2022, Tenable has provided plugin coverage ahead of NVD for 32,862 vulnerabilities, of which 531 had not yet been fully disclosed in NVD (as of Dec. 31, 2022).

To show the full scope of the coverage gap facing cybersecurity teams, we also analyzed 16 software vendors whose products are commonly used in many large organizations. Fig. 1 shows the number of CVEs per vendor for which Tenable provided plugin coverage either prior to or on the same day a vulnerability was fully disclosed on NVD during the period of Jan. 1, 2000 – Dec. 31, 2022. Among these vendors, we found there was an average delay of 117 days between when a vulnerability was first discovered and when it was fully disclosed on NVD.

Fig. 1

Reference period: January 1, 2000 - December 31, 2022

Source: Tenable Research, April 2023

In the reference time period (2000 - 2022), the top five vendors for which Tenable filled the biggest percentage of plugin coverage ahead of the vulnerabilities being fully disclosed on NVD are:

1. Apple (17.4%)
2. Google (16.3%)
3. IBM (16.2%)
4. Solarwinds (12.9%)
5. Slackware (11.0%)

In 2022 we observed the following (cumulative) assets:

• 15+ million running Apple software
• 97+ million assets running Google software
• 16+ million assets running IBM software
• 500.000+ assets running Solarwinds software

About The Mind the Gap series

This four-part Mind the Gap blog series is a valuable resource for security professionals that provides an overview of the observed vulnerability landscape with a focus on vulnerabilities discovered by Tenable Research before detailed information appeared on the NVD. This series stems from the analysis of our own dataset, one of the most extensive and rich datasets in the industries. Through the years, we gathered a broad knowledge of the vulnerability landscape, enmeshed with Tenable Research-specific insights and reporting capabilities.

Other blogs in this series:

• Mind the Gap: How Waiting for NVD Puts Your Organization at Risk
• Mind the Gap: A Closer Look at the Vulnerabilities Disclosed in 2022
• Mind the Gap: A Closer Look at Eight Notable CVEs from 2022

Learn More

• Download the 2022 Threat Landscape Report
• Read the blog, Exposure Management: Our Vision for Securing the Modern Attack Surface
• View the webinar, Analyst Roundtable: How Exposure Management Helps You Gain Visibility, Prevent Attacks, and Communicate Risk for Better Decision Making