Vulnerability Management

---
name: vulnerability-management
description: Runs the loop from discovering a weakness to confirming it is fixed — scanning, triage, prioritization by real exploitability, remediation tracking, and patch policy. Use this to stand up or fix a vulnerability program, triage scanner output, decide what to fix first, set patch SLAs, handle a disclosure from an outside researcher, or report posture to leadership.
---

# Vulnerability management

Scanners are cheap and produce more findings than any team can fix. The whole discipline is deciding
what actually matters and closing those.

## Prioritize by exploitability, not by score

A published severity score describes the vulnerability in the abstract. What matters is your
instance of it. Rank by:

- **Is it reachable?** Internet-facing beats internal beats unreachable code path by a wide margin. A
  critical in a dependency you import but never call is not a critical for you.
- **Is it being exploited in the wild?** Known-exploited status should outrank a higher score that
  nobody is using.
- **What does exploitation yield here?** Compromise of the system holding customer data outranks the
  same bug on a build agent.
- **Is there a compensating control**, and does it actually work?

A queue sorted purely by severity guarantees the team spends its time on the wrong things while a
medium-rated, internet-facing, actively exploited bug waits.

## Triage discipline

Every finding gets one of four outcomes, each recorded: **fix**, **mitigate**, **accept** (with an
expiry and a named owner), or **false positive** (with the reason).

Nothing sits untriaged. An unreviewed backlog of thousands is the normal failure mode and it means
the program is not running, whatever the dashboard says.

Tune the scanner. Persistent false positives train the team to dismiss everything, including the
real finding.

## Patch policy

Set SLAs by severity and exposure, publish them, and measure against them. Then measure the number
that breach the SLA — that number, not the raw count, is the health of the program.

Have an emergency path for actively exploited vulnerabilities that bypasses the normal cycle, agreed
in advance. Deciding how to ship an out-of-band patch during the incident wastes the hours that
matter.

## Dependencies

Most findings will be in third-party code. Keep dependencies current continuously rather than in
large periodic jumps — a small regular upgrade is routine, a two-year jump is a project, and the
project gets deferred.

Know what you actually ship. A dependency inventory you cannot produce means you cannot answer "are
we affected" when the next widely-exploited library bug lands, and that question arrives with a
clock attached.

## External disclosure

Publish a way to report a vulnerability and an address that is monitored. Researchers who cannot
find one disclose publicly instead.

Acknowledge quickly, give a realistic timeline, keep them updated, and credit them. Treating a
good-faith reporter as an adversary is how a private report becomes a public one.

## Reporting

Leadership needs: what is exposed and unfixed past SLA, the trend, and what needs a decision. Not
the count of findings, which mostly measures how much you scanned.

## Tooling

Infrastructure scanning: Tenable, Qualys, Rapid7 InsightVM, and similar. Code and
dependencies: Snyk, Dependabot, GitHub Advanced Security, Semgrep, Trivy, and similar.
Cloud posture: Wiz, Orca, Prisma Cloud, and similar.

Exploitability context — the CISA KEV catalog, EPSS scores — decides what you fix first.
The scanner only decides what you know about.

## Never

- Rank on CVSS alone. A score is not exploitability in your environment.
- Accept a risk without a named accepting owner and a date it gets revisited.
- Push a patch to production without knowing what it changes and how to roll it back.
- Report a shrinking backlog that shrank by reclassification rather than by remediation.