Last updated at Wed, 26 Jul 2017 15:53:47 GMT
We just released a new version of NeXpose to all of our users that has a new technology we call Exploit Exposure ™. Exploit Exposure will now give you exploit information about a particular vulnerability. Why is this important? The Rapid7 vulnerability database contains checks for over 12,000 vulnerabilities, and most organizations have a lot of vulnerabilities that need to be prioritized – more vulnerabilities than they have time to correct. Now, with Exploit Exposure, you will know which vulnerabilities have real exploits (thanks to our links to both Metasploit and Exploit Database) and you can fix those vulnerabilities first.
In addition, NeXpose uses the exploit ranking data from the Metasploit team to classify the skill level required for a given exploit. Since you can't predict the skill level of an attacker, we strongly recommend that you immediately remediate any vulnerability that has a live exploit, regardless of the skill level required for an exploit or the number of exploits available for a given vulnerability. At the same time, we wanted to give you the full information so you can make an informed decision.
With Exploit Exposure, NeXpose tells you what you need to remediate right now without needing to buy any other products, Google for a vulnerability, or search. This tells you your real-world risk and what you need to remediate. Unlike patch-centric prioritization schemes which can lull administrators into a false sense of security, this vulnerability-centric approach covers all known exploit paths into your system. For example, a 0-day vulnerability is flagged immediately (given the presence of an exploit) even if a patch is not yet available. We give you possible remediation actions for 0-days (e.g., add a firewall rule) so that your organization is protected.
This is just the tip of the iceberg in terms of what we want to accomplish by sharing data between NeXpose and Metasploit, so stay tuned for more. I'm also interested in hearing your feedback, so please post to the nexpose-users mailing list or a comment in the blog below. If you want to see Exploit Exposure firsthand, download the free NeXpose Community Edition.
