vulnerability-management

Vulnerability management

Scanners are cheap and produce more findings than any team can fix. The whole discipline is deciding

what actually matters and closing those.

Prioritize by exploitability, not by score

A published severity score describes the vulnerability in the abstract. What matters is your

instance of it. Rank by:

• Is it reachable? Internet-facing beats internal beats unreachable code path by a wide margin. A

critical in a dependency you import but never call is not a critical for you.

• Is it being exploited in the wild? Known-exploited status should outrank a higher score that

nobody is using.

• What does exploitation yield here? Compromise of the system holding customer data outranks the

same bug on a build agent.

• Is there a compensating control, and does it actually work?

A queue sorted purely by severity guarantees the team spends its time on the wrong things while a

medium-rated, internet-facing, actively exploited bug waits.

Triage discipline

Every finding gets one of four outcomes, each recorded: fix, mitigate, accept (with an

expiry and a named owner), or false positive (with the reason).

Nothing sits untriaged. An unreviewed backlog of thousands is the normal failure mode and it means

the program is not running, whatever the dashboard says.

Tune the scanner. Persistent false positives train the team to dismiss everything, including the

real finding.

Patch policy

Set SLAs by severity and exposure, publish them, and measure against them. Then measure the number

that breach the SLA — that number, not the raw count, is the health of the program.

Have an emergency path for actively exploited vulnerabilities that bypasses the normal cycle, agreed

in advance. Deciding how to ship an out-of-band patch during the incident wastes the hours that

matter.

Dependencies

Most findings will be in third-party code. Keep dependencies current continuously rather than in

large periodic jumps — a small regular upgrade is routine, a two-year jump is a project, and the

project gets deferred.

Know what you actually ship. A dependency inventory you cannot produce means you cannot answer "are

we affected" when the next widely-exploited library bug lands, and that question arrives with a

clock attached.

External disclosure

Publish a way to report a vulnerability and an address that is monitored. Researchers who cannot

find one disclose publicly instead.

Acknowledge quickly, give a realistic timeline, keep them updated, and credit them. Treating a

good-faith reporter as an adversary is how a private report becomes a public one.

Reporting

Leadership needs: what is exposed and unfixed past SLA, the trend, and what needs a decision. Not

the count of findings, which mostly measures how much you scanned.

Sources

references/sources.md in this skill lists the outside authorities that settle the questions

here — what each one is authoritative for, and what you may do with it. Check them before

answering on anything they cover, and cite what you used. Most are free to read and not free

to reproduce; the use note on each is binding.

Tooling

Infrastructure scanning: Tenable, Qualys, Rapid7 InsightVM, and similar. Code and

dependencies: Snyk, Dependabot, GitHub Advanced Security, Semgrep, Trivy, and similar.

Cloud posture: Wiz, Orca, Prisma Cloud, and similar.

Exploitability context — the CISA KEV catalog, EPSS scores — decides what you fix first.

The scanner only decides what you know about.

Never

• Rank on CVSS alone. A score is not exploitability in your environment.
• Accept a risk without a named accepting owner and a date it gets revisited.
• Push a patch to production without knowing what it changes and how to roll it back.
• Report a shrinking backlog that shrank by reclassification rather than by remediation.