Omdia Report: Trend Disclosed 60% of Vulnerabilities

What is Trend’s Zero Day Initiative?

Trend’s Zero Day Initiative (ZDI) was created to encourage the reporting of 0-day vulnerabilities privately to the affected vendors by financially rewarding researchers. At the time, there was a perception by some in the information security industry that those who find vulnerabilities are malicious hackers looking to do harm. Some still feel that way. While skilled, malicious attackers do exist, they remain a small minority of the total number of people who discover new flaws in software.

Incorporating the global community of independent researchers also augments our internal research organizations with the additional zero-day research and exploit intelligence. This approach coalesced with the formation of the ZDI, launched on July 25, 2005.

Trend’s ZDI operates as a global community of security researchers and experts dedicated to identifying and addressing the latest cybersecurity vulnerabilities. The approach is proactive: instead of waiting for vulnerabilities to be exploited in the wild (zero-day vulnerabilities), Trend works to discover, disclose, and help mitigate these issues before they can be exploited maliciously. Today, Trend’s ZDI is the world’s largest vendor-agnostic bug bounty program. Their approach to the acquisition of vulnerability information is different than other programs. No technical details concerning the vulnerability are sent out publicly until the vendor has released a patch. Should the vendor not release a patch within 120 days, select details of the vulnerability are published on Trend’s ZDI website. This disclosure timeline ensures vendors do not ignore the report.

The Significance of Trend’s Dominance in Vulnerability Disclosures

1. Comprehensive Threat Coverage: Trend’s role in 60% of all vulnerability disclosures demonstrates its extensive reach and capability in identifying security flaws across various platforms and technologies. This ensures that companies relying on Trend and it’s Vision One platform receive thorough protection against a broad spectrum of threats.

2. Breaking Down Severity:

• Critical Vulnerabilities (57%): Critical vulnerabilities pose the highest risk, as they can lead to severe breaches if exploited. Trend’s significant share in disclosing these vulnerabilities highlights its critical role in protecting organizations from the most dangerous threats.
• High Severity Vulnerabilities (58%): High severity vulnerabilities, though slightly less critical, can still cause substantial damage. Trend’s expertise in identifying these vulnerabilities ensures that companies can address them promptly and effectively.
• Medium Severity Vulnerabilities (68%): Even medium-severity vulnerabilities can be exploited for malicious purposes. There are many instances where multiple medium-severity bugs can be chained together to exploit a target. Trend’s proactive identification of these vulnerabilities helps in maintaining robust overall security hygiene.

3. Proactive Risk Mitigation: By disclosing vulnerabilities before they are exploited, Trend allows companies to implement necessary patches and defenses. This proactive approach minimizes the window of exposure and reduces the risk of successful cyberattacks.

4. Trust and Reliability: The high percentage of disclosures by Trend builds trust in its capabilities. Companies can rely on Trend’s findings to make informed decisions about their cybersecurity strategies, knowing they are backed by one of the most active and reliable initiatives in the field.

According to IBM’s annual Cost of a Data Breach Report, the average cost of a data breach due to an initial access unknown (0-day) vulnerability in 2023 reached an all-time high of $4.45 million. This figure underscores the significant financial impact that security incidents can have on organizations. Factors contributing to these costs include detection and escalation, notification, post-breach response, and lost business.

Given Trend’s significant role in vulnerability disclosures, leveraging Trend to help manage enterprise attack surface risk is a natural for global enterprises, delivering compelling customer value:

• Comprehensive Protection: Trend offers a comprehensive cybersecurity platform designed to address a wide range of threats, complemented by the proactive insights and threat research provided by the ZDI that enables Trend to give better context for each vulnerability found within an organization.
• Innovative Solutions: With a focus on threat research and innovation, Trend continuously evolves its cybersecurity offerings to stay ahead of emerging threats identified through initiatives like the ZDI.
• Global Reach: Trend’s global network of independent researchers ensures that vulnerabilities across diverse technologies and geographies are identified and addressed promptly, offering companies a scalable and globally relevant cybersecurity solution.

Conclusion

The Omdia report underscores the pivotal role of Trend Micro’s Zero Day Initiative in the cybersecurity landscape. Trend’s ZDI program has been responsible for the majority of coordinated vulnerability disclosures over the last decade, and that trend looks to continue in 2024 and beyond. By leveraging Trend’s proactive and comprehensive approach to vulnerability management, organizations can stay ahead of potential threats, ensuring their digital assets are safeguarded against emerging cyber risks.

In a world where cyber threats are becoming increasingly sophisticated, the expertise and proactive measures offered by Trend provide a vital layer of defense, making it an essential partner for any organization committed to robust cybersecurity and better attack surface risk management. You can learn more about the program at our website and follow the team on Twitter, Mastodon, LinkedIn, or Instagram for the latest in exploit techniques and security patches.

Read More HERE