Vulnerability management

Scanners are cheap and produce more findings than any team can fix. The whole discipline is deciding what actually matters and closing those.

Prioritize by exploitability, not by score

A published severity score describes the vulnerability in the abstract. What matters is your instance of it. Rank by:

• Is it reachable? Internet-facing beats internal beats unreachable code path by a wide margin. A critical in a dependency you import but never call is not a critical for you.
• Is it being exploited in the wild? Known-exploited status should outrank a higher score that nobody is using.
• What does exploitation yield here? Compromise of the system holding customer data outranks the same bug on a build agent.
• Is there a compensating control, and does it actually work?