Research
Research
Published work, with the methods and the code open so the math can be checked.
Modeling Local Exploit Hazard: A Bayesian Framework for Quantifying Exploit Risk and Operational Efficiency
Jul 2026Shaffer & Voicu · arXiv:2607.24618 · cs.CR · CC BY-SA 4.0
- Control effectiveness treated as a probability distribution, seeded from an expert opinion pool and updated by Beta-Binomial inference on telemetry, BAS or pen-test evidence.
- Per-vulnerability likelihoods become hazard rates via survival analysis, with a Weibull shape calibrated against KEV timing.
- Hazards add under independence, so rates roll up from host to network to business unit to organization.
- Remediation plans are simulated and ranked by projected hazard reduction, which makes prioritization under fixed capacity explicit.
Related
Talks covering the same ground, and the code behind the paper.