IBM's Concert Triage Engine Revolutionizes Vulnerability Assessment

The current vulnerability scoring system (CVSS) is being used to determine which vulnerabilities are most severe, but this approach has its limitations. According to IBM, CVSS scores don't take into account whether a vulnerability can actually be exploited in a specific environment.

This issue has become more pressing with the rise of AI-assisted code generation and automated fuzzing, which have led to a surge in candidate vulnerabilities that security teams struggle to manually review.

IBM's solution is called Concert, a triage engine that combines two lines of analysis to determine whether a vulnerability can be exploited. The first line traces the code, while the second maps the deployment to see if an attacker can reach the vulnerable code from the internet.

The system provides four verdicts: Confirmed, Likely, Investigate, and Cleared. A confirmed or likely finding should trigger a remediation workflow, while an investigated finding offers an analyst partial data flow graph and a starting point for further analysis.