Prioritizing vulnerability scan results

A computer system for prioritizing vulnerability scan results, the computer system comprising:

• a bus system;
• a storage device connected to the bus system, wherein the storage device stores program instructions;
• and
• a processor device connected to the bus system, wherein the processor device executes the program instructions to:
• receive vulnerability scan results data corresponding to an asset of a network of data processing systems from a vulnerability scanner;
• parse the received vulnerability scan results data to group the vulnerability scan results data by vulnerability identifiers, wherein the vulnerability identifiers associated with the vulnerability scan results are assigned prior to parsing the asset of the data processing system;
• associate a corresponding security threat information identifier with each vulnerability identifier;
• perform a correlation of each associated security threat information identifier with a set of current vulnerability exploit data that corresponds to that particular security threat information identifier and is retrieved from at least one exploit data source;
• determine current security threat information that affects host data processing systems in the network based on the correlation between each associated security threat information identifier and its corresponding set of current vulnerability exploit data;
• and
• prioritize the current security threat information based on a number of corresponding current vulnerability exploit attacks identified from the at least one exploit data source.

A computer program product, embodied in a non-transitory computer readable storage medium for prioritizing vulnerability scan results, having program instructions stored therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:

• receiving vulnerability scan results data corresponding to an asset of a network of data processing systems from a vulnerability scanner;
• parsing the received vulnerability scan results data to group the vulnerability scan results data by vulnerability identifiers, wherein the vulnerability identifiers associated with the vulnerability scan results are assigned prior to parsing the asset of the data processing system;
• associating a corresponding security threat information identifier with each vulnerability identifier;
• performing a correlation of each associated security threat information identifier with a set of current vulnerability exploit data that corresponds to that particular security threat information identifier and is retrieved from at least one exploit data source;
• determining current security threat information that affects host data processing systems in the network based on the correlation between each associated security threat information identifier and its corresponding set of current vulnerability exploit data;
• and
• prioritizing the current security threat information based on a number of corresponding current vulnerability exploit attacks identified from the at least one exploit data source.