Vulnerability Forecasting Technical Colloquium

Cambridge United Kingdom, GB, September 25-26, 2025

The vulnerability forecasting community gathers each year to discuss how we can estimate/forecast/predict the number of vulnerabilities we will have to manage. Note that management is different things to different stakeholders. If you do coordinated disclosure you want to know how many remediations you will be doing, but if you are an attack surface monitoring company you want to know how many patches you might have to push or recommend. We're also interested in exploits and exploitation; how to count both, or how to explain the cost of developing them or repairing the harm. We're interested in data sources and formats, and how those formats shape our predictions.

We believe strongly that cyber security will become better the more we can predict about the vulnerability ecosystem.

Call for Papers

Submission Guidelines

This is a workshop for practitioners as well as academics. Those with a job or those that want one. We ask that you submit a 45 minute talk on a subject you think the community will be interested in. We do not ask you to have a full academic paper, but we respect it if you do. On the other hand if you have code and visualisations we respect that equally.

As usual we have two tracks:

• Full presentations on day one with a focus on methods and results
• Light workshops on day two with a focus on data sources or works in progress

Submit your talks here: https://easychair.org/cfp/25-V4CTC
Submissions are due by 2025-07-26.

List of Topics

• Measuring various aspects of vulnerabilities contributing vulnerability management
• Forecasting or prediction related to vulnerabilities, exploits, and associated incidents
• Decision support and science of security with respect to vulnerability management
• Data sources or data formats
• including Exploits, Exploitation and/or their features

Committees

Organizing Committee

• Matilda Rhode
• Éireann Leverett
• Art Manion
• Jeroen van der Ham-de Vos

Programming Committee

• Matilda Rhode
• Arwa Al Alsadi
• Éireann Leverett
• Art Manion
• Jeroen van der Ham-de Vos
• Natalie Kilber
• Celine Pypaert
• Jay Jacobs

Champions of the Student

We will make arrangements for students to attend for free again, but this is now by sponsorship. So we expect between around 30 free tickets to be released by lottery, the exact number will depend on our sponsorship results. Badges for students will be marked as sponsored by the company that did so, and we encourage the student attendees to spend a little time with our sponsors.

This helps us keep student tickets free, but also grow the conference from year to year.

Sponsorships Available

Sponsorship gives your organization different avenues to reach both experienced and up-and-coming vulnerability management and cybersecurity data science professionals. A motivated community of interest makes a good event, but sponsorship makes the event great. Sponsorship helps defray various event costs including the venue, food and beverage, keynote, and travel. Perhaps more importantly, sponsorship supports new people and new thinking by covering ticket costs for a number of students.

To discuss sponsorship opportunities please contact one of the Program Committee members at events@first.org.

Sponsorship Prospectus

Registration

Registration is $140.00 USD to attend. Funding a Symposium is the responsibility of the organizers. Your admission fee will help us cover facility and catering costs. Credit card, ACH, wire transfer, and purchase order options available. To register, please use the link below.

Register Now!

Travel to Cambridge

Air

The closest airport is Stansted, but typically it is only useful for short hops from Europe. For international travel it is more likely that you will arrive into Heathrow, Gatwick, Luton, or London City Airport. Many of these will offer train access which you can use to get to Cambridge, or you can book a car for 90-150 GBP.

Train

The Eurostar terminus is in St Pancras, which is across the street from King’s Cross in London where trains run every twenty minutes to Cambridge. You can also get to Cambridge from London via London Bridge or Liverpool Street Stations. There are both fast and slow trains on these routes, giving a variety of cost and speed. Keep in mind the city centre is about 20-30 mins walk from the train station, or a short taxi ride.

Bus

Flixbus and others offer services directly to Cambridge Central or to Trumpington Park and Ride. These services are very inexpensive and extend quite far across the UK and Europe.

Rail and Sail

It is possible to get a ferry into Felixstowe and a train into Cambridge for the carbon conscious traveller.

Venue

The conference will be held in: Cambridge, England at Darwin College. A lovely city where we can relax, enjoy talks, walks, punting, and wine. We can accommodate up to 120 guests this year, and we expect to have a rich collection of social events. The city has a lot of history to give us and in keeping with the rolling tradition of our conference, it is not the capital city but still worthy of your time and visit.