Knowing the exploitability and severity of software vulnerabilities helps practitioners
prioritize vulnerability mitigation efforts. Researchers have proposed and evaluated many …

Cyber risk management largely reduces to a race for information between defenders of ICT
systems and attackers. Defenders can gain advantage in this race by sharing cyber risk …

Software vulnerabilities are weaknesses in source code that can be potentially exploited to
cause loss or harm. While researchers have been devising a number of methods to deal …

The security demands on modern system administration are enormous and getting worse.
Chief among these demands, administrators must monitor the continual ongoing disclosure …

In recent years, the number of vulnerabilities discovered and publicly disclosed has shown a
sharp upward trend. However, the value of exploitation of vulnerabilities varies for attackers …

Each year, thousands of software vulnerabilities are discovered and reported to the public.
Unpatched known vulnerabilities are a significant security risk. It is imperative that software …

In recent years, many organizations have established bounty programs that attract white hat
hackers who contribute vulnerability reports of web systems. In this paper, we collect publicly …

Current reward structures in security vulnerability disclosure may be skewed toward
benefitting nefarious usage of vulnerability information rather than responsible disclosure …

Ransomware is a malicious class of software that utilises encryption to implement an attack
on system availability. The target's data remains encrypted and is held captive by the …

Bug-bounty programs have the potential to harvest the effort and diverse knowledge of
thousands of independent security researchers, but running them at scale is challenging …