Notes on vulnerability management operations.
How we think about coverage, finding lifecycle, prioritization and the decisions a security team has to make every week.
Not checked is not the same as clean
A missing result can mean remediation, failed authentication or reduced scope. Here is the evidence to check before calling a finding resolved.
Read →
When rescans inflate the vulnerability backlog
Repeated observations should preserve evidence without creating repeated work. The difficult part is deciding when reports describe the same issue.
Read →
When KEV, EPSS and asset context disagree
A CVSS Base score cannot set remediation order alone. Work through conflicting exploitation signals, exposure and business impact, and record why the decision changed.
Read →
What does zero findings actually mean?
Zero, stale and unavailable are different reporting states. Make coverage, freshness and denominators visible before a dashboard number reaches a management report.
Read →
A rescan should not erase a risk decision
Preserve accepted risks and false-positive decisions without freezing them forever. Define the evidence, expiry and changes that should trigger review.
Read →
The CVE has no NVD score. What should the team do?
Since April 2026, CVEs outside NIST's priority groups are not scheduled for immediate enrichment. Check other scoring sources, triage on applicability, reachability and exploitation evidence, and keep missing enrichment visible whether or not a score arrives.
Read →
The patch is unavailable: choosing and validating a compensating control
Choose a compensating control by naming the attack path it breaks, then validate it from the attacker's side. Record scope, evidence, expiry and review triggers so the control outlives the person who set it up.
Read →
Exposure without a CVE: who owns the fix?
An exposed admin interface or an over-broad bucket policy has no CVE and often no owner. Here is how to give those findings the same evidence, ownership and lifecycle as a patchable vulnerability.
Read →