This is akin to increased testing and diagnostics for a disease, lots of false positives and negatives, plus many flagged instances which would otherwise be benign.
Increasing visibility is always preferable, but the spectrums of quantity and quality become broader and less consistent as it expands.
The one example I’m aware of is prostate cancer. Diagnosis went through the roof when better testing became available, but the majority of the increase wouldn’t have a meaningful impact on the patients life quality or longevity.
My interpretation of the graph from this post is it’s the initial volley of potential instances from a new diagnostic tool, literally the low-hanging fruit. It’s mildly useful and somewhat interesting, but as with anything constituted from statistics, it’s an incomplete picture.
CVEs are allocated to any issue that gets flagged as a potential security issue; their severity is a subcategory, and their impact and relevance are wildly dependent on context and peripheral elements.
Not all CVEs are equal.
This is akin to increased testing and diagnostics for a disease, lots of false positives and negatives, plus many flagged instances which would otherwise be benign.
Increasing visibility is always preferable, but the spectrums of quantity and quality become broader and less consistent as it expands.
That’s a nice hot take. Got any data to back that up?
The one example I’m aware of is prostate cancer. Diagnosis went through the roof when better testing became available, but the majority of the increase wouldn’t have a meaningful impact on the patients life quality or longevity.
My interpretation of the graph from this post is it’s the initial volley of potential instances from a new diagnostic tool, literally the low-hanging fruit. It’s mildly useful and somewhat interesting, but as with anything constituted from statistics, it’s an incomplete picture.
Ah, well I certainly agree with the general notion you’ve stipulated. My question for data was regarding the quality of the CVEs, not the concept.
CVEs are allocated to any issue that gets flagged as a potential security issue; their severity is a subcategory, and their impact and relevance are wildly dependent on context and peripheral elements.