Sign up for our daily briefing

Make your busy days simpler with the Axios AM and PM newsletters. Catch up on what's new and why it matters in just 5 minutes.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Catch up on the day's biggest business stories

Subscribe to the Axios Closer newsletter for insights into the day’s business news and trends and why they matter.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Sign up for Axios Pro Rata

Dive into the world of dealmakers across VC, PE and M&A with Axios Pro Rata. Delivered daily to your inbox by Dan Primack and Kia Kokalitcheva.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Sports news worthy of your time

Binge on the stats and stories that drive the sports world with the Axios Sports newsletter. Sign up for free.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Tech news worthy of your time

Get our smart take on technology from the Valley and D.C. with Axios Login. Sign up for free.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Get the inside stories

Get an insider's guide to the new White House with Axios Sneak Peek. Sign up for free.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Catch up on coronavirus stories and special reports, curated by Mike Allen everyday

Catch up on coronavirus stories and special reports, curated by Mike Allen everyday

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Denver news?

Get a daily digest of the most important stories affecting your hometown with Axios Denver

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Des Moines news?

Get a daily digest of the most important stories affecting your hometown with the Axios Des Moines newsletter.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Twin Cities news?

Get a daily digest of the most important stories affecting your hometown with Axios Twin Cities

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Tampa Bay news?

Get a daily digest of the most important stories affecting your hometown with the Axios Tampa Bay newsletter.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Charlotte news?

Get a daily digest of the most important stories affecting your hometown with Axios Charlotte

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Nashville news?

Get a daily digest of the most important stories affecting your hometown with the Axios Nashville newsletter.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Columbus news?

Get a daily digest of the most important stories affecting your hometown with the Axios Columbus newsletter.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Dallas news?

Get a daily digest of the most important stories affecting your hometown with the Axios Dallas newsletter.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Austin news?

Get a daily digest of the most important stories affecting your hometown with the Axios Austin newsletter.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Atlanta news?

Get a daily digest of the most important stories affecting your hometown with the Axios Atlanta newsletter.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Philadelphia news?

Get a daily digest of the most important stories affecting your hometown with the Axios Philadelphia newsletter.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Chicago news?

Get a daily digest of the most important stories affecting your hometown with the Axios Chicago newsletter.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Sign up for Axios NW Arkansas

Stay up-to-date on the most important and interesting stories affecting NW Arkansas, authored by local reporters

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top DC news?

Get a daily digest of the most important stories affecting your hometown with the Axios DC newsletter.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Illustration: Sarah Grillo/Axios

A recent study found that only 5.5% of security vulnerabilities discovered by researchers were actually ever used by hackers.

Why it matters: That number makes instinctive sense to experts but can seem counterintuitive to anyone outside the field. That's because all vulnerabilities are not created equal — and in a world with hundreds of bugs released a week, prioritizing the important ones is key to any defense.

The big picture: If the 5.5% statistic sounds jarring, you're not alone. Jay Jacobs, the lead author on the study, says he thought it'd be higher, too.

  • "When I first started working with vulnerabilities, I had that reaction," he said, "I saw that and thought the data must be wrong. I went to an expert to ask if the data seemed normal, and he said [nonchalantly] yeah, why?"
  • "You want to think it's like animals in the wild, and the vulnerabilities are their food sources. Why wouldn't they take all the food sources?"

The reasons they wouldn't can vary. Most hacking is criminal, not espionage, and criminal hackers tend to make decisions based on hacking the most computers with the least amount of effort. Not all vulnerabilities are easy to use and not all of the easy to use vulnerabilities are in products that are widely deployed.

The impact: The number of vulnerabilities used by hackers matters because there are far more new vulnerabilities each month affecting any organization than any organization can patch.

  • In fact, in research he published in conjunction with Kenna Security, Jacobs found that organizations only patch 10% of newly found vulnerabilities each month regardless of the organization's size.
  • Patching isn't just a matter of hitting the "update" button. Updates, while critical, can sometimes interfere with crucial software, and often need to be tested before being applied.

What's needed: That makes prioritizing vulnerabilities key. And that means taking several factors into account.

  • Companies often are quick to assume that the most important factor is the most obvious one: the severity of a bug. But understanding the exposure of a system to attacks and what defenses are already in place are equally important.
  • "Organizations that are more mature will overlay asset management. If a high severity bug is in a server that’s better positioned, it might be able to wait," said Katie Moussouris, founder and CEO of Luta Security.

One factor not to take into account? Us. Or more accurately, media exposure of a vulnerability in general.

  • "If you read the announcements, everything is the end of the world," said Renaud Deraison, co-founder and CTO of Tenable, whose products manage vulnerability patching.
  • Tenable released a study last month demonstrating that there's no correlation between the amount of media attention a vulnerability receives and the urgency of patching it.
  • Take for example the recent series of microprocessor vulnerabilities at Intel and other companies. "Everyone went to patch their CPU. It was a very disruptive, a very invasive thing to patch, and in the end there wasn't an attack," he said.

Go deeper

Advocates fret Roe v. Wade's 49th anniversary could be its last

Photo: Leigh Vogel/Getty Images for Women's March Inc

As Saturday marks the 49th anniversary of Roe v. Wade, the Supreme Court's landmark decision that legalized abortion access in the U.S., advocates warn the ruling is "more at risk now than ever."

The big picture: The Supreme Court in December heard a challenge to a Mississippi 15-week abortion ban that could throw Roe's survival into question, or at least narrow its scope.

Updated 10 hours ago - Politics & Policy

Omicron dashboard

Illustration: Brendan Lynch/Axios

  1. Health: Pfizer and Moderna boosters overwhelmingly prevent Omicron hospitalizations, CDC finds — Omicron pushes COVID deaths toward 2,000 per day — The pandemic-proof health care giant.
  2. Vaccines: The case for Operation Warp Speed 2.0 — Starbucks drops worker vaccine or test requirement after SCOTUS ruling — Kids' COVID vaccination rates are particularly low in rural America.
  3. Politics: Biden concedes U.S. should have done more testing — Arizona says it "will not be intimidated" by Biden on anti-mask school policies — Federal judge blocks Biden's vaccine mandate for federal workers.
  4. World: American Airlines flight to London forced to turn around over mask dispute — WHO: COVID health emergency could end this year — Greece imposes vaccine mandate for people 60 and older — Austria approves COVID vaccine mandate for adults.
  5. Variant tracker

Arizona governor sues Biden administration over COVID funds tied to mandates

A teacher prepares a hallway barrier to help students maintain social distancing at John B. Wright Elementary School in Tucson, Arizona, on Aug. 14, 2020. Photo: Cheney Orr/Bloomberg via Getty Images

Arizona Gov. Doug Ducey (R) filed a lawsuit Friday against the Biden administration for ordering the state to stop allocating federal COVID relief funds to schools that don't comply with public health recommendations such as masking, the Arizona Republic reports.

Why it matters: The Treasury Department said last week that the state would have to pay back the money if Ducey does not redesignate the $173 million programs to ensure they don't "undermine efforts to stop the spread of COVID-19."