  Why wait for zero-days when you could predict them in advance? It is possible
to predict the volume of CVEs released in the NVD as much as a year in advance.
This can be done within 3 percent of the actual value, and different predictive
algorithms perform well at different lookahead values. It is also possible to
estimate the proportions of that total volumn belonging to specific vendors,
software, CVSS scores, or vulnerability types. Strategic patch management
should become much easier, with this uncertainty reduction.
