Microsoft will launch a vulnerability prediction service with today’s giant security update - 11 updates for Windows, Office and Internet Explorer.
The move is designed to help IT departments prioritise their patching efforts.
Announced more than two months ago , the "Exploitability Index" will be added to the bulletins that accompany each update. Microsoft's security experts will rate each vulnerability using a three-step ranking, in descending order of severity:
- Consistent exploit code likely
- Inconsistent exploit code likely
- Functioning exploit code unlikely
Microsoft expects that users and corporate IT administrators will combine the index rating with the company's current threat rankings, which estimate the potential impact as "critical" through "low," to prioritise patches.
The company is also expected to reveal more information about another new programme it talked about in August, Microsoft Active Protections Program (MAPP).
An information-sharing effort, MAPP gives select security vendors an early jump on crafting exploit signatures by providing technical details of to-be-patched vulnerabilities before updates are issued. Prior to the programme, security vendors had to wait like any customer for Microsoft to issue its patches before they could begin examining the bugs and start developing anti-exploit protection.
Microsoft has not said which security vendors are participating in the program, how far in advance they are given the information, or even the amount or type of data Microsoft will share.