![](\"https:\/\/mms.businesswire.com\/media\/20260804771351\/en\/2867108\/5\/The-End-of-Guesing-book-cover.jpg\")
<\/a><\/a>![](\"https:\/\/mms.businesswire.com\/media\/20260804771351\/en\/2867106\/4\/Root_Evidence_Logo.jpg\"){kind=logo}
<\/a><\/a>\nTheir new book, \u201cThe End of Guessing,\u201d debuts this week at Black Hat USA<\/a>, making the case that vulnerability management has become an exercise in managing volume rather than reducing risk. The authors argue that security teams are overwhelmed by millions of findings while lacking the evidence needed to determine which vulnerabilities actually lead to breaches<\/p> \n\u201cThe cybersecurity industry has spent decades optimizing for visibility,\u201d said Grossman. \u201cWe\u2019ve built better scanners, better dashboards, and more sophisticated scoring systems. What we've never done is focus on whether or not we have enough evidence to know whether we\u2019re fixing the vulnerabilities that actually matter. That\u2019s our focus at Root Evidence and the argument we make in this book.\u201d<\/p> \nDrawing on decades of experience in vulnerability research, attack surface management, digital forensics, and cyber insurance, the book argues that security teams have spent years making remediation decisions in the dark, and without access to the evidence to know which vulnerabilities actually lead to breaches that cause financial loss and they will continue to flounder under the weight of meaningless vulnerabilities and industry\u2019s increasing demands to fix them all.<\/p> \nThe book introduces a new framework for understanding vulnerability management, one centered on external attack surface visibility, real-world exploitation, and the economics of cybercrime. Rather than treating every vulnerability as equally urgent, the authors argue that organizations should prioritize the small percentage of exposures that have consistently led to successful attacks and financial loss.<\/p> \n\u201cFor years we\u2019ve accepted guessing as the cost of doing business in cybersecurity,\u201d said Hansen. \u201cWe don\u2019t think that's necessary anymore. Today we have enough evidence from incident response, threat intelligence, and cyber insurance to fundamentally change how organizations prioritize risk.\u201d<\/p> \nGrossman and Hansen will be signing free copies of \u201cThe End of Guessing\u201d<\/i> this week at Black Hat<\/a> at the Nucleus Security<\/a> booth (#5533):<\/p> \nAttendees are invited to meet the authors, discuss the ideas behind the book, and learn how evidence-based vulnerability management is reshaping the future of cyber risk reduction.<\/p> \nHansen shares his thoughts on why they wrote the book in a blog post \u2013 \u201cThe Story Behind \u2018The End of Guessing\u2019<\/a>\u201d<\/a> \u2013 published today on the Root Evidence blog<\/a>.<\/p> \nAbout \u2018The End of Guessing\u2019<\/b><\/p> \n\u201cThe End of Guessing\u201d explores why vulnerability management has reached a breaking point and presents a practical framework for prioritizing cyber risk using evidence drawn from real-world exploitation, attack surface intelligence, digital forensics, and cyber insurance. The book is intended for security leaders, practitioners, and executives seeking a more effective approach to reducing cyber risk in an era of rapidly expanding attack surfaces. \u201cThe End of Guessing\u201d is now available on Amazon in paperback format and on Kindle<\/a>.<\/p> \nAbout Root Evidence<\/b><\/p> \nRoot Evidence is a cybersecurity company pioneering evidence-based vulnerability management to help organizations focus on the small percentage of vulnerabilities that are actually exploited in the wild, have caused reported breaches, and led to material financial losses. With Root Evidence, security teams can measurably reduce financial risk, prioritize remediation efforts where they have the greatest impact, and reduce the likelihood of breaches. Founded in 2025 by Jeremiah Grossman, Robert Hansen, Heather Konold, and Lex Arquette, the company is headquartered in Boise, Idaho and backed by Ballistic Ventures<\/a>, Grossman Ventures<\/a>, and leading cybersecurity experts.<\/p>\n