  Modern organizations struggle with insurmountable number of vulnerabilities
that are discovered and reported by their network and application vulnerability
scanners. Therefore, prioritization and focus become critical, to spend their
limited time on the highest risk vulnerabilities. In doing this, it is
important for these organizations not only to understand the technical
descriptions of the vulnerabilities, but also to gain insights into attackers'
perspectives. In this work, we use machine learning and natural language
processing techniques, as well as several publicly available data sets to
provide an explainable mapping of vulnerabilities to attack techniques and
threat actors. This work provides new security intelligence, by predicting
which attack techniques are most likely to be used to exploit a given
vulnerability and which threat actors are most likely to conduct the
exploitation. Lack of labeled data and different vocabularies make mapping
vulnerabilities to attack techniques at scale a challenging problem that cannot
be addressed easily using supervised or unsupervised (similarity search)
learning techniques. To solve this problem, we first map the vulnerabilities to
a standard set of common weaknesses, and then common weaknesses to the attack
techniques. This approach yields a Mean Reciprocal Rank (MRR) of 0.95, an
accuracy comparable with those reported for state-of-the-art systems. Our
solution has been deployed to IBM Security X-Force Red Vulnerability Management
Services, and in production since 2021. The solution helps security
practitioners to assist customers to manage and prioritize their
vulnerabilities, providing them with an explainable mapping of vulnerabilities
to attack techniques and threat actors
