vuln-triage

Vulnerability Triage Skill

Scanners cry wolf — most findings aren't as urgent as their color suggests, and a "medium" reachable from the

internet can outrank a "critical" that isn't exploitable in your setup. This skill triages a vulnerability by

real, contextual risk: base severity adjusted for exploitability and exposure, with a fix and a

fix-by SLA. For assets you own or are authorized to assess.

Required Inputs

Ask for these only if they aren't already provided:

• The finding — the CVE/scanner/pentest item: what it is, affected component/version, CVSS if given.
• Your context — is the affected component reachable (internet-facing? authenticated-only? internal?), what data/privilege it touches, compensating controls in place.
• Exploit status — is there a known public exploit / is it being exploited in the wild (e.g. on CISA KEV)?
• Environment — prod vs. non-prod, blast radius, business criticality.

Output Format

Triage: [vuln / CVE / finding]

Verdict — one line: the contextual severity (Critical/High/Medium/Low) and the action (patch now / schedule / mitigate / accept), with the key reason.

Assessment

• Base severity — CVSS base score/vector if available, and what it means.
• Exploitability — is it reachable in your deployment? Preconditions (auth, network position, user interaction)? Public exploit / known exploited in the wild?
• Impact if exploited — the assets/data/privilege at stake; blast radius.
• Contextual severity — the base rating adjusted for the above (exposure + exploitability + compensating controls). Justify any change from the base.

Remediation

• Fix — the patch/upgrade/config change that resolves it.
• Mitigation — if you can't patch immediately: the interim control (WAF rule, disable feature, network restriction, rotate creds).
• Fix-by SLA — the deadline given the contextual severity (e.g. critical-exposed → hours; low-internal → next cycle).

Verification & notes — how to confirm it's fixed, and any monitoring to add.

Quality Checks

• [ ] Severity is assessed in context (exposure, exploitability, compensating controls) — not just the raw CVSS/scanner color
• [ ] Exploitability covers reachability, preconditions, and public/in-the-wild exploit status
• [ ] Both a real fix and an interim mitigation (if not immediately patchable) are given
• [ ] A fix-by SLA is assigned proportional to the contextual severity
• [ ] Verification and any monitoring/detection follow-ups are noted

Anti-Patterns

• [ ] Do not treat the scanner's rating as the answer — adjust for reachability and real impact
• [ ] Do not ignore exploit status — a known-exploited (KEV) bug jumps the queue regardless of score
• [ ] Do not give only "patch it" with no interim mitigation when patching will take time
• [ ] Do not assign a generic SLA — tie urgency to the contextual severity
• [ ] Do not triage assets you don't own or aren't authorized to assess

Based On

Vulnerability management practice (CVSS base/temporal/environmental, exploitability & KEV context, risk-based SLAs).