Vulnerability Triage

Vulnerability scanners produce volume, not priority. Effective triage cuts the list to an actionable queue engineers can work without burning out or quietly ignoring legitimate risk. The costly mistake this skill prevents is sorting by CVSS descending - which puts an unreachable library bug ahead of a trivially exploitable flaw on the public edge, and spends the team's scarce patching capacity in exactly the wrong order.

Operating procedure

Grouping comes before scoring because one root-cause fix can close ten findings; scoring before grouping wastes ten triage passes on one bug.

Step 1: Gather inputs

• The finding list with source (scanner, pentest, bounty) and reported CVSS per item.
• An exposure map: which services are internet-facing, which are internal-only, and what sits behind VPN, WAF, or MFA. If none exists, build a rough one from the load balancer and DNS config and label it a guess.
• Deployed versions and configuration for the affected components - the vulnerable config often is not the deployed config.
• Access to the CISA KEV catalog and exploit-availability data for the findings in question.
• The team's remediation capacity, so SLAs are commitments rather than fiction.

Step 2: Deduplicate and group by root cause

Scanners report the same root cause through multiple symptoms. Group findings by shared cause (example: every XSS finding traced to the same template-engine misconfiguration) before scoring anything. One fix may close ten findings - identify these first for maximum leverage.