Ed Bellis

Ed Bellis

Kenna Security

Co-Founder and CTO

Ed Bellis, Co-founder and CTO of Kenna Security Ed Bellis is a security industry veteran and expert and known in security circles as “the father of risk-based vulnerability management.” He founded Kenna Security to deliver a data-driven risk-based approach to remediation and help IT teams prioritize and thwart would-be security threats. Ed is the former CISO of Orbitz and former Vice President, Corporate Information Security at Bank of America. He is an advisor to Dharma and former advisor to SecurityScoreboard.com and Society of Payment Security Professionals. Ed is a contributing author to the book, Beautiful Security (Oram, Andy & Viega, John, O’Reilly Media, 2009). He is a frequent speaker at industry conferences. Recent engagements include the 2017 Enterprise Security Summit (Dos and Don’ts of Establishing Metrics that Cultivate Real Security) and InfoSec World (Amateur Hour: Why APT’s Are the Least of Your Worries).

CISA Director Jen Easterly at her confirmation hearing in June. Today’s columnist, Ed Bellis of Kenna Security, says Director Easterly has set the tone for a proactive security approach based on a private-public partnership. (Photo by Kevin Dietsch/Getty Images)

Governance, Risk and Compliance

CISA takes first step in prioritizing risk: what’s next?

Ed BellisDecember 23, 2021

New CISA Director Jen Easterly takes proactive, risk-based approach to vulnerability management.

Analysis of the NIST National Vulnerability Database shows that security teams were under siege in 2020 and into the first part of 2021 defending against an unprecedented number of flaws. Today’s columnist, Ed Bellis of Kenna Security, cautions that CVSS scores don’t always tell the full story. shioshvili is licensed under CC BY-SA 2....

Risk Assessments/Management

The danger of looking at risk scores without any context

Ed BellisApril 29, 2021

Analysis of the NIST National Vulnerability Database shows that security teams were under siege in 2020 and into the first part of 2021 defending against an unprecedented number of flaws. Today's columnist, Ed Bellis of Kenna Security, cautions that CVSS scores don't always tell the full story.

While Apple gets headlines for discovering zero-days, today’s columnist, Ed Bellis of Kenna Security, says true zero-days are rare. Bellis says the vast majority of vulnerabilities are patched before CVE publication. However, in the rare case when exploits predate the availability of a patch, attackers get a 47-day head start – and that’s something...

Patch/Configuration Management

How security teams can prevent a 47-day patching handicap

Ed BellisFebruary 2, 2021

While Apple gets headlines for discovering zero-days, today’s columnist, Ed Bellis of Kenna Security, says true zero-days are rare. Bellis says the vast majority of vulnerabilities are patched before CVE publication. However, in the rare case when exploits predate the availability of a patch, attackers get a 47-day head start – and that’s something security teams need to focus on.