The vulnerability forecasting community gathers each year to discuss how we can estimate/forecast/predict the number of vulnerabilities we will have to manage. Note that management is different things to different stakeholders. If you do coordinated disclosure you want to know how many mediations you will be doing, but if you are an attack surface monitoring company you want to know how many patches you might have to push or recommend. We're also interested in exploits and expliotation; how to count both, or how to explain the cost of developing them or repairing the harm. We're interested in data sources and formats, and how those formats shape our predictions.

We believe strongly that cyber security will become better the more we can predict about the vulnerability ecosystem.

Submission Guidelines

We do not ask you to have a full academic paper, but we respect it if you do. This is a workshop for practitioners as well as academics. Those with a job or those that want one. We ask that you submit a 45 min talk on a subject you think the community will be interested in.

List of Topics

• Predicting Vulnerabilites, Exploits, Exploitation and their features
• Counting or deduplicating vulnerabilities, exploits or exploitation
• Data sources or data formats

Committees

Organizing and Programming Committee

• Matilda Rhode
• Éireann Leverett
• Art Manion
• Jeroen van der Ham

Venue

The conference will be held in...Utrecht. A lovely city where we can relax and enjoy walks and talks. The exact venue will be disclosed in the coming months but should be suitable for 75-100 people to discuss their favourite topics.

Contact

All questions about submissions should be emailed to eireann(dot)leverett[at]cantab(dot)net