| name | Vulnerability Triage |
| description | Use when triaging CVEs, prioritizing vulnerabilities, or setting remediation SLAs. Triggers on 'CVE', 'vulnerability triage', 'CVSS', 'EPSS', 'SLA for patching', 'reachability'. |
Vulnerability Triage
When to invoke
- Scanner (SCA, SAST, container scan) dropped a batch of findings.
- A newly disclosed CVE affects a dependency we use.
- Defining or auditing the org's patching SLA.
Prioritization model
Don't triage by CVSS alone. Combine three signals:
- Severity - CVSS v3.1/v4 base score (intrinsic badness).
- Exploitability - EPSS score (probability of exploitation in the next 30 days) + presence in CISA KEV (known exploited).
- Reachability - is the vulnerable code actually executed? Is the exposed interface network-reachable? Is authentication required?
High priority = High/Critical CVSS AND (KEV OR EPSS > 0.1) AND reachable.
A Critical CVSS in a dev-only dependency not on the runtime path is lower priority than a Medium CVSS in an internet-facing service.
SLA template
| Severity | Internet-facing | Internal | Dev-only |
|---|
| Critical / KEV | 7 days | 14 days | 30 days |
| High | 30 days | 60 days | 90 days |
| Medium | 90 days | 90 days | Next release |
| Low | Next release | Next release | Backlog |
Clock starts at disclosure (or vendor patch), not at scan detection.
Workflow
- Dedupe & group - one vulnerability in a transitive dep may show 50 times; fix once.
- Verify reachability - call-graph tools (Snyk Reachability, Semgrep, Endor) or manual inspection of the vulnerable function.
- Fix hierarchy:
a. Upgrade to a patched version (preferred).
b. Apply vendor workaround / config mitigation.
c. Compensating control (WAF rule, network segmentation).
d. Accept with expiry - documented, owned, time-boxed (≤ 90 days, re-review).
- Close the loop - scanner must re-verify; don't trust "fixed in PR #123" without a clean scan.
- Track exceptions in a single registry with owner, justification, expiry, compensating control.
Anti-patterns
- Treating every Critical as page-worthy - alert fatigue, real issues drown.
- No reachability analysis - you'll chase phantom risks and miss real ones.
- Exception with no expiry - becomes permanent.
- "Fixed" means "PR merged" instead of "confirmed by rescan in the deployed environment."
References
