I saw the headline yesterday, “Security Experts Warn Firms of the Higher Risk of Lower-Risk Flaws.” It is the kind of headline that makes one do a double-take (the mark of a good headline, I suppose). But can it be true? Well, on the one hand, it could be justified simply by asserting that the risk associated with low risk vulnerabilities has simply increased from, say, really really low to simply low. This is sort of like when studies assert that your risk of getting cancer has quadrupled when it goes from .01% to .04%.

But there is an implied change of impact here, and the gist of the article is that those vulnerabilities that are listed as medium or… Continue reading: Can Lower Risk be Higher Risk?