Vulnerability triage and management

Tools produce hundreds of findings; triage decides which are real, who owns them, their priority and fix deadline, manages time-limited exceptions and measures MTTR so the process improves over time.

From findings to action

After switching on SAST, SCA, image, IaC and DAST scanning, even a mid-sized organisation can have thousands of findings. Triage filters them into concrete work:

flowchart TB
  subgraph S1["1. Sort"]
    direction LR
    F["New finding"] --> D{"Duplicate?"}
    D -- "yes" --> MG["Merge"]
    D -- "no" --> V{"Real or<br/>false positive?"}
    V -- "FP" --> FP["Mark with a reason"]
  end
  subgraph S2["2. Act"]
    direction LR
    P["Set priority + owner"] --> S["SLA by priority"]
    S --> X{"Fixable in time?"}
    X -- "yes" --> FIX["Fix, rescan to confirm"]
    X -- "no" --> EX["Approved, time-limited exception"]
  end
  S1 -- "real" --> S2

Prioritising in context

The tool's severity is only a starting point. Adjust it for:

Exploitability: listed in CISA KEV, high EPSS, a public exploit exists.
Exposure: internet-facing or internal only, authenticated or not.
Data: personal or payment data, or just an internal tool.
Reachability: whether the vulnerable code is actually called.

Sample SLAs

Priority	Suggested fix deadline
Critical (exploited, internet-facing)	24–72 hours
High	7–14 days
Medium	30–60 days
Low	90 days or as planned

The exact numbers are the organisation's decision; what matters is that they exist, are written down and are tracked.

Ownership

Findings must go to the team that owns the code or service, not pile up on the security team. Assign owners with CODEOWNERS, cloud resource tags or namespace labels. Aggregators such as DefectDojo, GitHub Security Overview and Dependency-Track merge results from many scanners, remove duplicates and assign work.

Exceptions (risk acceptance)

Sometimes a fix is not possible yet: no patch, too big a change, a system about to be retired. A valid exception has:

a reason and mitigations (a WAF rule, a disabled feature, a NetworkPolicy),
an accountable approver,
an expiry date, after which it must be reviewed.

Measuring

Metric	Meaning
MTTR	Mean time from detection to fix
SLA compliance	How many findings are fixed on time
Backlog by priority	Open Critical and High counts
Overdue exceptions	Expired exceptions not yet reviewed

Traps: sorting by CVSS while ignoring context; marking false positives without a reason; permanent exceptions; measuring findings found instead of findings fixed.