Microsoft's exploit predictions are right less than half the time
Microsoft Corp. today called its first month of predicting whether hackers will create exploit code for its bugs a success -- even though the company got its forecast right less than half the time.
"I think we did really well," said Mike Reavey, group manager at the Microsoft Security Research Center (MSRC), when asked for a postmortem evaluation of the first cycle of the team's Exploitability Index. "Four of the issues that we said where consistent exploit code was likely did have exploit code appear over the first two weeks. And another key was that in no case did we rate something too low."
The index, launched last month, rates each vulnerability using a three-step system. It predicts, in descending order of severity, the probability that researchers or hackers would come up with a consistently working exploit or develop an exploit that works only some of the time, or whether they would fail to craft attack code at all.
