Hello! I am submitting a proposal for the July 30th "CVE in an Era of AI-Enabled Vulnerability Discovery" virtual conference.
Format: Individual talk (can compress to a lightning talk if the agenda requires)
Theme alignment: Helping consumers make dependable prioritization and remediation decisions at higher speed and scale. Secondary: improving how vulnerability information flows through the ecosystem.
Speaker: Matthew Venne, stackArmor
Abstract
In June 2026, FedRAMP launched its Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules — and quietly retired the flat severity SLA. Under the new rules, every detected vulnerability must be evaluated three ways: is it internet-reachable? Is it likely exploitable? And what Potential Agency Impact N-rating (N1–N5) could exploitation carry? Those three answers — not the CVSS Base score — select the remediation deadline from a published timeframe matrix. CVSS is demoted to an input; context sets the clock.
This talk presents an open, published methodology for making those three determinations defensible and repeatable at scale, developed as a set of public white papers:
- Reachability as a computation, not a label. FedRAMP's definition of "internet-reachable," read maximally, tags nearly every finding in a connected system. We show a per-finding model — asset exposure gates, transfer functions across routing/filtering/authentication hops, and the vulnerability's own trigger requirements — where every factor is evidence-backed and every evidence gap defaults to reachable, so gaps surface as conservatism rather than silent false negatives.
- Impact from metrics that already exist. FedRAMP's "potential agency impact" maps almost one-to-one onto CVSS Environmental metrics. Asset archetypes assign CR/IR/AR once; the published CVSS formula plus a single-vs-multi-agency scope flag computes the N-rating deterministically. Same inputs, same N — and the assessor can re-run the arithmetic.
- What it does to a real backlog. Run against 5,771 real findings, the model modestly shortens the average clock (120 → 102 days) while redistributing urgency: paper-severity Criticals that nothing can reach relax, and "Low" findings on shared multi-agency infrastructure accelerate by months.
The methodology is directly relevant beyond FedRAMP: as AI-enabled discovery drives record publication volume up, the survivable consumption strategy is exactly this shape — computed, evidence-backed, environment-aware evaluation that turns a growing catalog into a defensible work queue.
White papers: https://github.com/stackArmor/rfc-fedramp-vdr
Takeaway
A concrete, reproducible pipeline — reachable? exploitable? how bad, here? — that any organization can implement with data it already has (scanner output, EPSS, KEV, asset metadata), and a real-data demonstration that context-based deadlines aim effort better than severity labels ever did.
Contact
Hello! I am submitting a proposal for the July 30th "CVE in an Era of AI-Enabled Vulnerability Discovery" virtual conference.
Format: Individual talk (can compress to a lightning talk if the agenda requires)
Theme alignment: Helping consumers make dependable prioritization and remediation decisions at higher speed and scale. Secondary: improving how vulnerability information flows through the ecosystem.
Speaker: Matthew Venne, stackArmor
Abstract
In June 2026, FedRAMP launched its Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules — and quietly retired the flat severity SLA. Under the new rules, every detected vulnerability must be evaluated three ways: is it internet-reachable? Is it likely exploitable? And what Potential Agency Impact N-rating (N1–N5) could exploitation carry? Those three answers — not the CVSS Base score — select the remediation deadline from a published timeframe matrix. CVSS is demoted to an input; context sets the clock.
This talk presents an open, published methodology for making those three determinations defensible and repeatable at scale, developed as a set of public white papers:
The methodology is directly relevant beyond FedRAMP: as AI-enabled discovery drives record publication volume up, the survivable consumption strategy is exactly this shape — computed, evidence-backed, environment-aware evaluation that turns a growing catalog into a defensible work queue.
White papers: https://github.com/stackArmor/rfc-fedramp-vdr
Takeaway
A concrete, reproducible pipeline — reachable? exploitable? how bad, here? — that any organization can implement with data it already has (scanner output, EPSS, KEV, asset metadata), and a real-data demonstration that context-based deadlines aim effort better than severity labels ever did.
Contact