Stephen Shaffer https://www.stephenshaffer.io/ Stephen Shaffer Introducing the Local Exploit Hazard Model https://www.stephenshaffer.io/blog/introducing-the-local-exploit-hazard-model An approach to synthesizing global and local exploit signals to quantify vulnerability remediation efficiency. Hacking Reality: Why Data Science Is the Blue Team’s Ultimate Exploit https://www.stephenshaffer.io/blog/hacking-reality-why-data-science-is-the-blue-teams-ultimate-exploit Security ships risk models and almost never checks them against what happened. The gap worth closing is observation infrastructure, not scoring. Vulnerability Information Cones https://www.stephenshaffer.io/blog/vulnerability-information-cones Light cones borrowed from physics as a mental model for deciding under imperfect information. Updating Exploit Likelihood with Control Effectiveness https://www.stephenshaffer.io/blog/quantifying-swiss-cheese-the-bayesian-way Putting numbers on the Swiss-cheese model: control effectiveness as a distribution, updated with evidence, then folded back into exploit likelihood. Modeling Asset Risk Using EPSS https://www.stephenshaffer.io/blog/modeling-asset-risk-using-epss Rolling per-CVE EPSS probabilities up to an asset-level view of exploitation risk. Determining EPSS Score Thresholds for Prioritization https://www.stephenshaffer.io/blog/determining-epss-score-thresholds-for-prioritization Where to draw the line, and what it costs you when you draw it in the wrong place. Flipping the Vulnerability Management Model: CVSS → SSVC https://www.stephenshaffer.io/blog/flipping-the-vulnerability-management-model-cvss-ssvc My take on leveraging SSVC over CVSS for vulnerability action prioritization. Sabermetrics and Cyber Risk Quantification https://www.stephenshaffer.io/blog/sabermetrics-and-cyber-risk-quantification What sabermetrics did for the game, and where it points for cyber risk. Learning How to Quantify Cyber Risk Using Bayes https://www.stephenshaffer.io/blog/learning-how-to-quantify-risk-using-bayes A walk through Bayesian thinking for cyber risk: priors, evidence, and updating as new data arrives.