The DBIR’s ‘Forest’ of Exploit Signatures
Summary: Trail of Bits argues that the 2016 Verizon DBIR's vulnerability section, contributed by Kenna Security, is built on correlations between vulnerability scanner output and IDS alerts rather than confirmed data breaches, and that its 'top 10' list wrongly includes the TLS FREAK flaw, Windows 95 denial-of-service issues, and 15-year-old UPnP exploits. The post notes Kenna claimed 200+ million successful exploit events, while real-world cases like Duqu, Stuxnet, and the Hacking Team breach used only one to four exploits each.
What you should know: The DBIR is described as the single best source of information for enterprise defenders, and this section's list omitted client-side vectors like Flash that appear prominently in Microsoft data and APT reporting - so a leader prioritizing patching from it may be acting on scanner and IDS noise rather than the exploits attackers actually use.
Read the original at Trail of Bits Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026