The good, the bad, and the vulnerable

This report from Wiz examines cloud-focused vulnerability management, highlighting benefits such as reduced attack surface through smaller images and streamlined patching in serverless/SaaS, while noting increased complexity and reliance on vendors for visibility and patches. It proposes a methodology to prioritize CVEs in cloud contexts by assessing technology prevalence, exposed attack surface, and the value to threat actors (e.g., initial access potential), emphasizing that many traditional third‑party software flaws may have limited real-world impact in cloud environments.