LESIS Bulletin #3

Introduction

This month we highlight recent research from the LESIS team, share an open-source tool designed for security investigations, and look at a development shaping the industrial cybersecurity landscape.

Research & Articles

Economic taxonomy of vulnerabilities

Understanding the financial cost of a vulnerability is one of the hardest challenges in cybersecurity. Traditional risk models often rely on qualitative assessments, but security decisions also need objective economic references that can support prioritization, budgeting, and investment planning.

This article analyzes bug bounty reward data as a market-based proxy for estimating vulnerability discovery cost across different severity levels. By examining real payout patterns, it shows how vulnerability value tends to increase with severity and why robust measures such as median and interquartile range are more useful than simple averages.

The study helps translate vulnerability management into economic terms, offering practical references for Expected Vulnerability Discovery Cost and supporting more data-driven decisions about security investment, resource allocation, and risk prioritization.

State machine for vulnerability management

In vulnerability management, inconsistent status definitions can create confusion, weaken traceability, and make reliable metrics difficult to produce. When different teams use the same statuses with different meanings, communication breaks down and the response to real risks becomes less effective.

This article presents a formal state machine for vulnerability management, defining each stage of the vulnerability lifecycle with clear transitions, from Draft and Identified to Fixing, Retest, Fixed, Duplicated, False Positive, and Accepted Risk.

The goal is not to add bureaucracy, but to create a shared operational language. A well-defined state machine helps teams reduce ambiguity, improve collaboration, support audits, identify bottlenecks, and make better decisions across security, product, and engineering.

Tool Spotlight

Sentra — The first autonomous source code posture risk score tool

Sentra is a tool designed to help teams assess and improve the security posture of their source code repositories. It provides a set of Perl modules that can analyze GitHub organizations and repositories, collect security metrics, check repository maintenance status, verify Dependabot configuration, and identify the presence of security tooling such as SAST, secret scanning, and SCA.

By bringing together information from GitHub security features, including Dependabot alerts, secret scanning alerts, and code scanning alerts, Sentra helps teams gain visibility into the maturity of their security processes across multiple repositories. This makes it easier to identify gaps, prioritize improvements, and understand where additional controls may be needed.

The project can be used to run individual checks or broader security posture assessments, either across an entire GitHub organization or against a specific repository. It also supports Slack notifications through webhooks, allowing security findings and operational messages to be shared directly with teams.

The project is open source and available for use and contribution.

LESIS Accepted into Anthropic’s Cyber Verification Program

LESIS has been accepted into Anthropic’s Cyber Verification Program, enabling our organization to use Claude for approved cybersecurity research use cases within the scope submitted to Anthropic.

This approval allows LESIS to explore AI-assisted workflows related to vulnerability analysis, offensive security tooling, exploitation research, secure development, and technical investigation processes in a responsible and policy-compliant way.

The approval applies only to the approved LESIS organization and remains subject to Anthropic’s Usage Policy and ongoing monitoring. Safeguard adjustments may be narrowed or revoked if activity falls outside the approved use cases.

For LESIS, this is an important step toward expanding responsible AI-assisted security research and studying how advanced language models can support cybersecurity work without replacing technical expertise, ethical boundaries, or human review.

LESIS Sponsors RioCyberSec Happy Hour

LESIS is proud to sponsor the next RioCyberSec Happy Hour, taking place on July 21 in Rio de Janeiro.

The event will bring together professionals, researchers, and enthusiasts from the cybersecurity community for an evening of networking, conversations, and knowledge sharing.

We invite everyone interested in cybersecurity to join us and be part of this moment with the community.

Closing

LESIS is an applied security research entity focused on developing effective offensive technologies in support of critical operations. Its approach is grounded in a thorough attacker’s perspective and rigorous, research-driven thinking

If you found this issue interesting, feel free to share it with colleagues working in security research.
​