Matthew Wollenweber

I would *love* to sit down with everyone who came up with this report. I was the independent person responsible to do patch analysis for very large companies and facilities for many years. By that I mean I was at one point the single person responsible for pulling the $12+ million dollar switch for several Forbes 100 companies. Matter of fact that's how most of my old school followers know me, I used to dump the work in real time here on Twitter to get more customers (it worked). So what does that mean? Patch Tuesday is a great example, it used to drop 10AM PST Tuesday. I would have an approx 50 page report Friday EoB to customers covering EVERY patch, ease of exploitation, profile the discovery team or person behind it, use in the wild, IoCs, weaponization likelihood in the next 24h, 72h, 7 days, 14 days, 30 days. No AI. Just IDA, DarunGrim, BinDiff, some tools I wrote and a dream. I would be in the office, Tuesday leave Friday, yes, that's correct, no home, straight working. I performed this service from 3 different companies to various customers. Sometimes it was with a select team, most of my career it was solo. So what was the $12m switch? Well that was the cost it would be for just one of my customers to push out an emergency patch that wasn't in their already accepted patching procedures. That cost was electricity costs, server down time, service availability impact, employee costs, testing etc. I was the person that said: this patch needs to be pushed and that break glass needs to happen due to impact being greater than X million in a 72h period. I made that specific call maybe 11 times, in the 14 years that I did this service and I got that call twice. The last time I got the call wrong was one of the TCP.sys icmp vulns, ping of death style. I failed to account that another vendors vulnerability would come out to put it to shame and be far more easier to exploit with a PoC. The other time I got it wrong was exploitation happened about 96h instead of 72h. The science to get this precision is hard, I got lucky a few times. What I will say is the goal of the attackers, what is at risk, and level of sophistication that attackers will use completely vary from target to target. Also there's a ton of this exploitation data is simply not visible, a lot of this data isn't public and requires lots of embedded resources, sources, and detailed tracking. In almost all cases and scenarios during those 14 years: 0days are not kings, it's your trash exploits (auth bypass, file upload, hash leaks etc) that are 2 to 6 years old that got forgotten, unpatched, suddenly exposed to the Internet, or bridged over by a contractor that lead to massive incidents over and over.