Vulnerability management

Scanners are cheap and produce more findings than any team can fix. The whole discipline is deciding what actually matters and closing those.

Prioritize by exploitability, not by score

A published severity score describes the vulnerability in the abstract. What matters is your instance of it. Rank by:

• Is it reachable? Internet-facing beats internal beats unreachable code path by a wide margin. A critical in a dependency you import but never call is not a critical for you.
• Is it being exploited in the wild? Known-exploited status should outrank a higher score that nobody is using.
• What does exploitation yield here? Compromise of the system holding customer data outranks the same bug on a build agent.
• Is there a compensating control, and does it actually work?

A queue sorted purely by severity guarantees the team spends its time on the wrong things while a medium-rated, internet-facing, actively exploited bug waits.

Triage discipline

Every finding gets one of four outcomes, each recorded: fix, mitigate, accept (with an expiry and a named owner), or false positive (with the reason).

Nothing sits untriaged. An unreviewed backlog of thousands is the normal failure mode and it means the program is not running, whatever the dashboard says.

Tune the scanner. Persistent false positives train the team to dismiss everything, including the real finding.

Patch policy

Set SLAs by severity and exposure, publish them, and measure against them. Then measure the number that breach the SLA — that number, not the raw count, is the health of the program.

Have an emergency path for actively exploited vulnerabilities that bypasses the normal cycle, agreed in advance. Deciding how to ship an out-of-band patch during the incident wastes the hours that matter.

Dependencies

Most findings will be in third-party code. Keep dependencies current continuously rather than in large periodic jumps — a small regular upgrade is routine, a two-year jump is a project, and the project gets deferred.

Know what you actually ship. A dependency inventory you cannot produce means you cannot answer "are we affected" when the next widely-exploited library bug lands, and that question arrives with a clock attached.

External disclosure

Publish a way to report a vulnerability and an address that is monitored. Researchers who cannot find one disclose publicly instead.

Acknowledge quickly, give a realistic timeline, keep them updated, and credit them. Treating a good-faith reporter as an adversary is how a private report becomes a public one.

Reporting

Leadership needs: what is exposed and unfixed past SLA, the trend, and what needs a decision. Not the count of findings, which mostly measures how much you scanned.

Tooling

Infrastructure scanning: Tenable, Qualys, Rapid7 InsightVM, and similar. Code and dependencies: Snyk, Dependabot, GitHub Advanced Security, Semgrep, Trivy, and similar. Cloud posture: Wiz, Orca, Prisma Cloud, and similar.

Exploitability context — the CISA KEV catalog, EPSS scores — decides what you fix first. The scanner only decides what you know about.

Never

• Rank on CVSS alone. A score is not exploitability in your environment.
• Accept a risk without a named accepting owner and a date it gets revisited.
• Push a patch to production without knowing what it changes and how to roll it back.
• Report a shrinking backlog that shrank by reclassification rather than by remediation.