The Evidence blog

Writing on vulnerability management, cyber risk, and standing behind the work.

Why We Built the Evidence Platform

Our team built the Evidence Platform to solve vulnerability management with actuarial evidence, not guesswork. Learn how real-world breach and financial loss data shaped the Platform, why prioritization must focus on the vulnerabilities that matter most, and how the Warranty backs those recommendations with up to $5 million in coverage.

Jeremiah Grossman · Jul 28, 2026

VARs Aren't Making the Money They Used to Selling Vulnerability Management

VARs are not losing money because clients stopped caring about vulnerability management. They are losing money because selling raw scan results creates commodity margins, while selling focused, evidence-based risk reduction creates a service clients are willing to keep paying for.

Greg Reber · Jul 27, 2026

OEMs Are Licensing the Same VM Tool in Different Colors, and It's a Credibility Problem

Vulnerability management keeps promising prioritization, but most tools still leave customers asking what actually reduces business risk. This piece explains why OEM platform vendors and MSSPs need VM and ASM offerings that move beyond severity scores and show financial exposure in terms buyers can defend.

Greg Reber · Jun 30, 2026

CVSS 9.8

CVSS 9.8 looks like just another severe score, but the math and exploitation data suggest it may be one of the more important numbers in vulnerability management. This post explores why attackers may favor 9.8s over 10.0s, and what that reveals about the gap between theoretical severity and real-world risk.

Robert "RSnake" Hansen · Jun 25, 2026

$5,000,000 Mythos-era Warranty

Root Evidence’s warranty puts real accountability behind vulnerability prioritization. If a remotely exploited CVE leads to a breach, customers are covered for up to $5 million in financial loss.

Jeremiah Grossman · Jun 19, 2026

Why MSSPs Are Getting Fired (And Probably Know It)

MSSPs are not losing clients because they are inactive, but because they often fail to prove that their work reduced the risks that mattered most to the business. This piece argues that the providers who survive will be the ones that translate security activity into measurable financial exposure reduction, clear board-level narratives, and renewal-worthy business outcomes.

Greg Reber · Jun 16, 2026

Evaluating AI in Infosec

The best AI use cases in infosec are not the flashiest ones, but the ones that can survive failure, cost, and delay. This blog lays out a simple three-part test for separating useful security AI from features that look impressive in demos but collapse in production.

Robert "RSnake" Hansen · Jun 11, 2026

Just Fix Everything

Autopatching sounds like the obvious answer to AI-driven vulnerability discovery, but production systems are too complex and fragile for “just fix everything” thinking. This blog explains why LLM-powered patching may help in development, while autonomous patching in production introduces risks that can be worse than the vulnerabilities themselves.

Robert "RSnake" Hansen · Jun 9, 2026

What does ‘Defensibility’ mean to a CISO?

CISOs are no longer judged only on whether they prevented a breach, but on whether they can prove their decisions were reasonable, documented, and financially defensible. This piece explains why defensibility is becoming a core requirement for modern security leaders and the vendors who sell to them.

Greg Reber · Jun 1, 2026

What “Due Care” Actually Means in Vulnerability Management

A vulnerability backlog will never be perfectly cleared, but boards need proof that security teams prioritized the risks most likely to cause real financial harm. This article argues that defensible vulnerability management is not about fixing everything, it is about showing due care where it matters most.

Jeremiah Grossman · May 20, 2026

AI Failure Mode: Lie. And how will that impact vulnerability management?

AI doesn’t fail loudly, it fails convincingly, producing confident answers that can be completely wrong. This blog explores why that makes it uniquely dangerous in security and how misplaced trust can waste time on threats that don’t even exist.

Greg Reber · May 14, 2026

Removing 3rd Party CVEs

What if you could eliminate most third-party vulnerabilities by rewriting the code entirely? This blog explores using Lib-Theseus to replacing risky dependencies, and why focusing on the vulnerabilities that actually matter is still the real win.

Robert "RSnake" Hansen · May 12, 2026

Explaining the Myth of Mythos

Mythos may dramatically increase vulnerability discovery, but it amplifies the real problem rather than solving it: knowing which flaws actually matter. This blog explains why prioritization, asset visibility, and real-world risk data are more critical than ever in an AI-driven security landscape.

Greg Reber · May 5, 2026

AI and the Artisan Vulnerability Researcher

AI won’t eliminate vulnerability research, it will raise the bar, making discoveries rarer, harder, and more dependent on elite expertise. This blog explores how automation reshapes the field and why the future belongs to highly skilled, “artisan” security researchers.

Jeremiah Grossman · May 4, 2026

Mythos Preview vs VM Reality: What Changes When AI Finds “Everything”

Mythos and similar AI tools may accelerate vulnerability discovery, but they don’t change the fundamentals of how real attacks succeed. This blog explains why attackers already have everything they need and why defenders must shift focus to prioritizing the risks that actually lead to loss.

Jeremiah Grossman · May 1, 2026

The Blue Team is a Losing Man’s Game

Is the Blue Team doomed to lose, or just playing the wrong game? This piece breaks down the structural disadvantages defenders face and argues that shifting the economics of cybersecurity is the key to finally gaining the upper hand.

Robert "RSnake" Hansen · Apr 29, 2026

AI Malware Woes

A grounded look at why AI-generated malware is often far less dangerous than the hype suggests, from outdated tactics to obvious mistakes that make detection easier. Read this post for a sharp, insider take on how real attackers operate and why today’s AI tools may be giving defenders more of an advantage than adversaries.

Robert "RSnake" Hansen · Apr 22, 2026

It’s Not Their Fault (they did the best they could at the time…)

Why do legacy vulnerability management platforms still overwhelm teams with endless CVE lists? Read how outdated risk models from Tenable, Qualys, and Rapid7 create noise at a time when security teams need precision.

Greg Reber · Apr 21, 2026

AI Security will be Bolted On

Everyone wants AI to be secure by design, but cybersecurity history suggests that some defenses will always be added later as real attacks reveal what no one could fully predict upfront. This blog explains why the winners in AI security will not be the teams that guess best at the start, but the ones that adapt fastest once real-world evidence shows what actually matters.

Jeremiah Grossman · Apr 16, 2026

The Cost of Cybersecurity Will Exceed the Cost of Breach

This blog explores why traditional, asset-based cybersecurity pricing is breaking down as attack surfaces expand faster than breach costs, especially in large enterprises. Read it to see how AI-driven growth is forcing security teams and vendors to rethink pricing, prioritization, and what actually reduces risk.

Jeremiah Grossman · Apr 14, 2026

Application Security Won. The Industry Missed It.

Application Security did not win by eliminating vulnerabilities. It won by making common web app attacks less reliable, less scalable, and less profitable for attackers. This blog argues that the real measure of success is not fewer flaws, but forcing adversaries to change tactics and proving why that shift matters now more than ever.

Jeremiah Grossman · Apr 9, 2026

The AI Vulnerability Surge That Doesn’t Change a Thing

Cybersecurity has a long history of overhyping the next big threat, and AI-driven vulnerability exploitation may be the latest example. This blog challenges the panic with a sharper question: if attackers already ignore most known vulnerabilities, what really changes when AI helps them find more?

Jeremiah Grossman · Apr 7, 2026

Subrogation Lawsuits as Peer Pressure

Explore how subrogation lawsuits are reshaping cyber insurance into a powerful force for accountability, turning security marketing claims into measurable, outcome-driven proof. This blog explains why insurers may become the industry’s most effective regulators and what that means for underwriting, vendor risk, and security investment decisions.

Robert "RSnake" Hansen · Apr 1, 2026

Companies Buried in Vulnerabilities Still Get Insured. How?

Companies are overwhelmed by vulnerabilities, yet still qualify for cyber insurance. This blog explores what actuarial data reveals about which vulnerabilities actually lead to financial loss and why most don’t matter as much as we think.

Jeremiah Grossman · Mar 24, 2026

Why We Built Evidence Scan the Way We Did

Evidence has launched the enterprise preview of Evidence Scan, a scalable vulnerability scanner designed to identify the risks that truly matter. Learn how it helps security teams cut through vulnerability noise and focus on the issues most likely to cause real-world financial loss.

Robert “RSnake” Hansen · Mar 12, 2026

Announcing the Evidence Scan Enterprise Preview

We’ve spent years refining the math of loss. Now, we’re making that same "Loss-First" intelligence available directly to security teams. We are officially launching the Enterprise Preview for Evidence Scan: the first tool designed to let you see exactly which of your vulnerabilities could lead to breaches or real-world financial loss.

Root Evidence · Mar 9, 2026

The Difference Between Vuln Severity and Financial Exposure

Cyber insurance is won or lost in the gap between CVSS “severity” and real-world financial exposure. This post explains why pricing and remediation should be driven by empirically exploited loss drivers, not theoretical scores, and how that shift sharpens underwriting and portfolio performance.

Robert "RSnake" Hansen · Mar 5, 2026

Millions of Vulns

Organizations are reporting tens or even hundreds of millions of vulnerabilities, yet few appear to translate into real-world attacks or losses. This piece explores that contradiction and asks an uncomfortable question: if these flaws rarely change outcomes, why are vulnerability counts still used to define risk?

Robert "RSnake" Hansen · Feb 11, 2026

Datasources are not Created Equal

Not all threat intelligence feeds are created equal. This post explains why high-fidelity data built on direct observation of real compromises delivers clearer, more actionable security insight than rule-based feeds full of noise.

Robert "RSnake" Hansen · Feb 6, 2026

Who Measures Risk Better

A sharp examination of the opposing incentives between vulnerability management vendors and cyber insurers reveals why counting vulnerabilities is a poor proxy for real risk. By reframing evidence around actual loss instead of noise, this piece argues for a more honest way to measure what truly changes security outcomes.

Robert "RSnake" Hansen · Feb 4, 2026

The ‘Dark Energy’ of Orphaned External IT Devices

A compelling analogy between dark energy and orphaned, internet-facing systems reveals how forgotten assets quietly expand enterprise attack surfaces. It shows why unmanaged infrastructure becomes an invisible but powerful breach vector, and why exposing and eliminating these hidden systems is critical to preventing real-world compromises.

Greg Reber · Jan 29, 2026

Cyber Security Incentives

Cybersecurity is broken less by attackers than by the incentives shaping our tools, teams, and decisions. This post breaks down why risk based security is mostly a myth, how volume and fear replaced insight, and what it will take to realign the industry around outcomes that actually reduce loss.

Robert "RSnake" Hansen · Jan 26, 2026

From Aristotle to CVSS: Why First Principles Matter in Cyber Risk

We are drowning in confident conclusions built on shaky assumptions. This post shows how applying first principles thinking cuts through bad data, false causation, and noisy vulnerability scores to focus security decisions on what actually leads to real breaches.

Greg Reber · Jan 22, 2026

Peak Patch Management and Busy Work

This blog challenges the belief that patch management alone reduces risk, arguing that blindly fixing millions of vulnerabilities without adversary context often wastes time and resources. It makes the case for prioritizing patches based on how attackers actually operate, not on raw vulnerability counts.

Robert "RSnake" Hansen · Jan 20, 2026

Moneyball in Infosec

Infosec is still playing the wrong game, trusting expert intuition, CVSS scores, and tradition instead of outcomes that actually prevent loss. This post argues for an Infosec Moneyball approach that replaces security theater with rigorous, dollar-driven decisions focused on what truly reduces breach and business impact.

Robert "RSnake" Hansen · Jan 13, 2026

The Cognitive Bias Behind Cyber Risk Scoring

This blog uses a surprising deck of cards analogy to expose a critical misunderstanding in cybersecurity: why CVSS scores measure severity, not risk. Learn how separating impact from likelihood leads to smarter vulnerability prioritization and better business aligned security decisions.

Greg Reber · Jan 9, 2026

The Vulnerability Management Warranty

Are your vulnerability management and external attack surface programs actually working, or just reporting success? This post challenges conventional security metrics and argues that only warranties and real accountability can prove whether risk is truly being found, prioritized, and reduced.

Robert "RSnake" Hansen · Jan 6, 2026

Evidence: 2025 Year in Review

Evidence’s first year charts its evolution from an idea into a movement, redefining vulnerability management through evidence-based prioritization, community collaboration, and real-world results. Read how practitioner insight, design partners, and a focus on measurable risk shaped the product and what comes next.

Root Evidence · Dec 30, 2025

CVSS V4 vs V3

Read about why CVSS 4.0 struggles to gain real adoption, how its added complexity can reduce practical scoring resolution, and why base scores continue to undermine meaningful risk prioritization. This post breaks down the technical, philosophical, and incentive-driven reasons CVSS V4 has not fixed the problems it set out to solve.

Robert “RSnake” Hansen · Dec 22, 2025

The Importance of Prebuilt EASM

Read why traditional EASM approaches fail to deliver a reliable picture of what organizations actually expose to the internet and why accurate, real-time asset inventory is becoming a prerequisite for both security and cyber insurance decisions.

Robert "RSnake" Hansen · Dec 18, 2025

What Infosec Doesn’t Understand about Cyber Insurance

Read about how cyber insurance carriers actually evaluate risk, losses, and security controls, and why many long-held infosec assumptions don’t match actuarial reality. This post breaks down how insurers really think about premiums, breaches, and which controls truly reduce financial loss.

Robert "RSnake" Hansen · Dec 15, 2025

Patching ROSI Math

A practical guide to using ROSI math to prioritize vulnerabilities based on real financial impact, not guesswork or compliance-driven patching.

Robert "RSnake" Hansen · Dec 11, 2025

When Old Assumptions Move Aside and Evidence Takes Over

A look at how history, and cybersecurity, keep proving that rational assumptions can still be wrong, and why the future of vulnerability management depends on evidence, not theory.

Greg Reber · Dec 9, 2025

Fast Scanning and Dwell Time

Rapid scanning and shared intelligence can shrink attacker dwell time, disrupt post-compromise movement, and meaningfully reduce breach impact.

Robert "RSnake" Hansen · Dec 4, 2025

AI and the Acceleration of CVEs

Discover why AI is set to dramatically increase CVE volume and how this shift will force security teams to rethink prioritization, triage, and long-term risk strategy.

Robert "RSnake" Hansen · Nov 20, 2025

Replacing Security Theatre with Real Risk Reduction

Security theatre gives organizations the illusion of safety. Shifting to true visibility and context-driven prioritization is what actually reduces real-world risk.

Greg Reber · Nov 19, 2025

The Unit Cost of Infosec

Cyber insurance is reshaping security. Vendors must deliver real efficacy and lower unit costs as market forces finally enforce accountability.

Robert "RSnake" Hansen · Nov 13, 2025

Vulnerability Management has always been about Evidence

Trace the evolution of vulnerability management from early scanners to evidence-based security. Learn how forensics and actuarial data are redefining prioritization and shaping the next generation of risk reduction.

Jeremiah Grossman · Nov 7, 2025

The Rational Rejection of Vulnerability Management

Explore why most vulnerability management efforts waste time and resources on low-impact flaws, and how a rational, evidence-based approach focused on real-world exploitation can redefine what “effective security” really means.

Robert "RSnake" Hansen · Nov 4, 2025

CVSS Base Scores

CVSS Base Scores were never meant to measure real risk. This post explains how their misuse distorts prioritization and why context (not convenience) must define vulnerability management.

Robert "RSnake" Hansen · Oct 27, 2025

At the Risk of CVSS

Expose why CVSS misleads: inconsistent math, context-free scores, poor correlation to real exploitation and loss, and version/data flaws. Then, replace it with evidence-based, loss-driven prioritization and ROSI-focused metrics.

Robert "RSnake" Hansen · Oct 20, 2025

The Epoch Theory of Cybersecurity

The Epoch Theory of Cybersecurity explains how attackers and defenders evolve through distinct eras, from manual exploits to scalable automation and, soon, AI-driven complexity. By understanding these epochs, organizations can anticipate shifts in attacker behavior, invest strategically, and force adversaries to spend more time and money, turning defense into an economic advantage.

Jeremiah Grossman · Oct 13, 2025

A Post-VM Warranty World

Explore the coming “post-VM warranty world,” where vulnerability management shifts from empty promises to accountability. As vendors begin offering warranties, only those that back limited, high-impact vulnerabilities with real financial risk will align with customer success.

Robert "RSnake" Hansen · Oct 12, 2025

What Enterprises Get Wrong About Vulnerability Management ROI

Expose the illusion of “fixing everything.” VM programs measure success by volume (tickets closed, vulns patched) but those metrics don’t reduce risk. True ROI comes from prioritizing exploited vulnerabilities and measuring avoided loss, not activity for activity’s sake.

Robert "Rsnake" Hansen · Sep 30, 2025