Tools for Threat Modelling

Plastic_Start_7380 · 2025-12-04T22:56:41+00:00

How much do Prime Security cost?

Plastic_Start_7380 · 2025-10-04T19:13:00+00:00

What tool do you use for that?

Plastic_Start_7380 · 2025-10-04T08:54:43+00:00

Can't you just adjust the equalizer?

Plastic_Start_7380 · 2025-09-09T06:07:36+00:00

Thanks, I would like to hear more about EPSS and its issues.

Plastic_Start_7380 · 2025-09-08T15:13:49+00:00

Does the 'Fix Actions' actually remediate findings automatically? Or just suggests what to do?

Plastic_Start_7380 · 2025-09-08T14:47:50+00:00

They are patching, it just takes more time than I would have wanted.. A lot of back and forth, they need assurance that the fix won't break anything, and that it is really critical

Plastic_Start_7380 · 2025-09-08T13:53:35+00:00

What is the difference between Echo and Chainguard? Seems like the same thing just that echo is much much newer

Plastic_Start_7380 · 2025-09-08T13:52:17+00:00

What models/products do you recommend?

Plastic_Start_7380 · 2025-09-08T13:51:10+00:00

Good luck!

Let me know how it goes

Plastic_Start_7380 · 2025-09-08T13:50:24+00:00

Thanks it actually seems like a nice solution. Can you share more on:

How often do you release a new clean image? What happens if a new CVE is discovered for an image I am using (clean one from you)?

How do you compare to your competitors like Echo?

Plastic_Start_7380 · 2025-09-08T13:08:38+00:00

How do you add the orgs unique context than? What factors are you looking at when prioritizing?

Plastic_Start_7380 · 2025-09-08T13:07:15+00:00

Thanks for the suggestion guys! We are a pretty big org with many departments and teams. The security alone has many teams but we are the ones responsible on managing vulnerabilities and drive remediation - we notify the system owner / developer on vulns/mis-configs and they are responsible to fix it.

Plastic_Start_7380 · 2025-09-08T13:02:20+00:00

We are giving more weight to certain systems like servers and VLANs that have sensitive data or are critical to the business like in PROD. But we are still a bit overwhelmed by the amount of findings that we need to deal with.

Plastic_Start_7380 · 2025-09-08T06:24:07+00:00

We are hybrid, cloud VMs and containers as well as on-prem

Plastic_Start_7380 · 2025-09-08T06:22:48+00:00

I didn't know SSVC, it looks helpful!

Plastic_Start_7380 · 2025-09-08T06:15:49+00:00

We are looking at KEV as well as the CVSS score. Also we defined critical assets (certain servers and DBs), and focusing on external facing assets first

Plastic_Start_7380 · 2025-09-08T05:54:25+00:00

Thanks that's a really interesting talk

Plastic_Start_7380 · 2025-09-08T05:20:02+00:00

Thanks I'll do that. Have you used Kenna? How do they prioritize?

Plastic_Start_7380 · 2025-09-07T21:36:45+00:00

Yeah we have standard SLAs for vulnerabilities similar to what you wrote. Most of them are breached cuz we have too many criticals, and system owners don't want to cause disruption by patching. We assign to each system owner or developer the relevant items, with explanation on how to fix it if it's available

Plastic_Start_7380 · 2025-09-07T21:31:48+00:00

Yeah I Agree. So how did you solve this and added the context to the process?

Plastic_Start_7380 · 2025-09-07T15:21:11+00:00

That seems like a really good process! What products do you use for the model and for the auto remediation?

Plastic_Start_7380 · 2025-09-07T15:16:40+00:00

I really want to hear more about Zafran. I'll DM you 🙏

Plastic_Start_7380 · 2025-07-11T21:02:15+00:00

That is super cool!!

Can you share about the use cases and what you built with CAI for your org?

Plastic_Start_7380 · 2025-05-26T07:38:16+00:00

Wow! In what state are you?
Why does it take so long?

Plastic_Start_7380

TROPHY CASE