Sectie Insights https://sectie.net/insights/ Practitioner notes on vulnerability management operations from Sectie. en Mon, 12 Oct 2026 00:00:00 GMT Not checked is not the same as clean https://sectie.net/insights/not-checked-is-not-clean/ https://sectie.net/insights/not-checked-is-not-clean/ Mon, 12 Oct 2026 00:00:00 GMT A missing result can mean remediation, failed authentication or reduced scope. Here is the evidence to check before calling a finding resolved. When rescans inflate the vulnerability backlog https://sectie.net/insights/one-finding-every-observation/ https://sectie.net/insights/one-finding-every-observation/ Mon, 12 Oct 2026 00:00:00 GMT Repeated observations should preserve evidence without creating repeated work. The difficult part is deciding when reports describe the same issue. When KEV, EPSS and asset context disagree https://sectie.net/insights/severity-is-not-priority/ https://sectie.net/insights/severity-is-not-priority/ Mon, 12 Oct 2026 00:00:00 GMT A CVSS Base score cannot set remediation order alone. Work through conflicting exploitation signals, exposure and business impact, and record why the decision changed. What does zero findings actually mean? https://sectie.net/insights/no-fabricated-data/ https://sectie.net/insights/no-fabricated-data/ Mon, 12 Oct 2026 00:00:00 GMT Zero, stale and unavailable are different reporting states. Make coverage, freshness and denominators visible before a dashboard number reaches a management report. A rescan should not erase a risk decision https://sectie.net/insights/operator-decisions-outrank-the-scanner/ https://sectie.net/insights/operator-decisions-outrank-the-scanner/ Mon, 12 Oct 2026 00:00:00 GMT Preserve accepted risks and false-positive decisions without freezing them forever. Define the evidence, expiry and changes that should trigger review. The CVE has no NVD score. What should the team do? https://sectie.net/insights/cve-without-nvd-score/ https://sectie.net/insights/cve-without-nvd-score/ Mon, 12 Oct 2026 00:00:00 GMT Since April 2026, CVEs outside NIST's priority groups are not scheduled for immediate enrichment. Check other scoring sources, triage on applicability, reachability and exploitation evidence, and keep missing enrichment visible whether or not a score arrives. The patch is unavailable: choosing and validating a compensating control https://sectie.net/insights/patch-unavailable-compensating-control/ https://sectie.net/insights/patch-unavailable-compensating-control/ Mon, 12 Oct 2026 00:00:00 GMT Choose a compensating control by naming the attack path it breaks, then validate it from the attacker's side. Record scope, evidence, expiry and review triggers so the control outlives the person who set it up. Exposure without a CVE: who owns the fix? https://sectie.net/insights/exposure-without-a-cve/ https://sectie.net/insights/exposure-without-a-cve/ Mon, 12 Oct 2026 00:00:00 GMT An exposed admin interface or an over-broad bucket policy has no CVE and often no owner. Here is how to give those findings the same evidence, ownership and lifecycle as a patchable vulnerability. EPSS v5: what changed and how to use it in prioritization https://sectie.net/insights/epss-v5-what-changed/ https://sectie.net/insights/epss-v5-what-changed/ Mon, 12 Oct 2026 00:00:00 GMT EPSS v5 replaced v4 as the model behind FIRST's daily scores on 2026-06-15, with no change required from consumers. Scores shifted on that date, so any comparison or threshold must record the model version and score date. KEV due dates and remediation SLAs: how to set deadlines that hold https://sectie.net/insights/kev-due-dates-and-remediation-slas/ https://sectie.net/insights/kev-due-dates-and-remediation-slas/ Mon, 12 Oct 2026 00:00:00 GMT A KEV due date is a federal deadline, not a universal SLA, and severity alone is a weak basis for one. Set deadlines from exploitation, exposure and impact, and measure whether they are met. Vulnerability scan false positives: how to prove, document and close them https://sectie.net/insights/documenting-scan-false-positives/ https://sectie.net/insights/documenting-scan-false-positives/ Mon, 12 Oct 2026 00:00:00 GMT A false positive means the reported condition is not present, and the record should show the evidence for that claim. Capture who verified it, when, for which assets, and what change should send it back for review. What a vulnerability risk acceptance record must contain https://sectie.net/insights/risk-acceptance-record/ https://sectie.net/insights/risk-acceptance-record/ Mon, 12 Oct 2026 00:00:00 GMT A risk acceptance record names the finding, the reason, the residual risk, who asked, who approved and when it expires. Without those fields an exception is just a closed ticket nobody can defend. CVSS v4.0 vs v3.1: what changes for prioritization https://sectie.net/insights/cvss-v4-vs-v3-1-for-prioritization/ https://sectie.net/insights/cvss-v4-vs-v3-1-for-prioritization/ Mon, 12 Oct 2026 00:00:00 GMT CVSS v4.0 changes the metric groups, the Base metrics and the way scores are calculated, so a v4.0 score and a v3.1 score for the same CVE can differ. A queue holding both needs the version and vector on every finding, and urgency set by exploitation evidence and asset context. How to measure vulnerability management coverage https://sectie.net/insights/measuring-vulnerability-management-coverage/ https://sectie.net/insights/measuring-vulnerability-management-coverage/ Mon, 12 Oct 2026 00:00:00 GMT An open-findings count says nothing about how much of the estate was actually assessed. Asset, authenticated, completion, freshness and unknown metrics, each with a stated denominator, answer that question.