A Scalable, Risk-Based Approach to Managing Vulnerabilities and Security Exposure

Thursday, April 30, 2026 | 11:30AM–12:30PM PT | Pacific Ballroom B, Second Floor
Session Type: Breakout Session
Delivery Format: Demonstrations
In 2023, Harvard launched a university-wide effort to modernize vulnerability management by shifting from a high-volume, reactive model to a risk-based approach. With that foundation, the University-Wide Vulnerability Management (UWVM) program has entered its next phase: expanding beyond traditional CVE-based vulnerabilities to address a broader set of security exposures. This session will briefly recap how the program built a scalable risk-based foundation by aligning stakeholders and standardizing risk prioritization in a decentralized environment. The focus will then shift to how that foundation is enabling the onboarding of additional exposure types, including cloud security posture issues, container vulnerabilities, and server configuration weaknesses. Rather than treating each domain separately, the program applies a consistent operating model that normalizes disparate signals into a unified, risk-driven view. The presentation will include a live demonstration showing how multiple exposure types are prioritized together, illustrating a shift from managing lists of findings to managing exposure and impact. The session will conclude with lessons learned from expanding beyond CVEs, including prerequisites for success, organizational challenges, and why a deliberate, incremental approach has been critical to sustaining momentum. Attendees will leave with practical guidance for building a risk-based security program that can grow as environments and threats evolve.

Presenters

  • Bill Dantowitz

    Vulnerability, Threat, & Exposure Management Engineer, Harvard University

  • Max Hyppolite

    Information Security, Harvard University

  • Faisal Yousuf

    Cloud Security Engineer, Harvard University

Resources & Downloads

  • CSPM SCM Harvard Vulnerability Exposure Management

    Updated on 4/21/2026