Vulnerability management
Vendor-neutral guides on prioritizing and remediating vulnerabilities for founders, CTOs, CISOs, and engineering leads — a program checklist, KEV, EPSS, and CVSS explained, remediation SLAs and timeframes, SBOM and open-source detection, zero-days, remediation proof, and accepted risk. Not legal advice.
What does a vulnerability management program checklist cover?
A master checklist for a vulnerability management program: inventory, scan coverage, ownership, SLAs, prioritization, exceptions, evidence. Not legal advice.
What is the difference between a vulnerability, an exploit, and risk?
A vulnerability is a weakness, an exploit is code that abuses it, and risk is likelihood times impact in context. Worked example. Not legal advice.
What is the difference between a CVE, a CWE, and a CVSS score?
CVE identifies a vulnerability, CWE classifies its root-cause weakness type, CVSS scores its severity. Annotated example vector. Not legal advice.
What is the CISA Known Exploited Vulnerabilities (KEV) catalog?
CISA's KEV catalog lists confirmed exploited CVEs. BOD 26-04 (10 June 2026) replaced BOD 22-01's flat 14-day rule with risk-tiered FCEB timelines. Not legal advice.
How should you prioritize vulnerabilities for remediation?
A triage order for vulnerabilities using KEV, EPSS, and CVSS together, plus CVSS-only vs SSVC vs EPSS-informed approaches compared. Not legal advice.
Exploitability vs. severity: which one should drive fix order?
CVSS scores impact; EPSS and KEV score exploitation. Why a high-CVSS finding is not automatically urgent, with a 2x2 quadrant and current EPSS v5 scoring notes.
How quickly should vulnerabilities be fixed?
CISA BOD 26-04 binds only FCEB agencies; PCI DSS v4.0.1 sets 30 days for critical patches, entity-defined for the rest. Most orgs set their own windows. Not legal advice.
How do you design vulnerability remediation SLAs?
An example risk-tier x days SLA matrix and a governance checklist for vulnerability remediation. No framework hands you fixed day-counts; you build your own. Not legal advice.
What is a software bill of materials (SBOM)?
An SBOM is a machine-readable component inventory in SPDX or CycloneDX. CISA sets US minimum elements; the EU CRA sets a legal floor if it applies. Not legal advice.
How do you find end-of-life dependencies before they bite?
A checklist for finding unsupported runtimes using endoflife.date and vendor lifecycle pages. No CVE yet is not the same as safe. Best practice, not legal advice.
How do you detect vulnerable open-source packages?
Software composition analysis: OSV, GitHub Advisory DB, NVD vs scanner heuristics, direct vs transitive deps, a worked example, and the reachability caveat. Not legal advice.
How do you handle a zero-day vulnerability?
Emergency triage for zero-day and actively-exploited vulnerabilities: mitigate now vs patch vs isolate, KEV monitoring, and the handoff to incident response. Not legal advice.
How do you prove a vulnerability was remediated?
Evidence checklist auditors typically expect for vulnerability remediation, a worked evidence trail, and framework requirement vs best practice. Not legal advice.
How do you track accepted security risk?
Exception-record template for accepted or deferred vulnerabilities: owner, justification, compensating controls, expiry, and sign-off. Not legal advice.
How does ShipReadyMetrics prioritize vulnerability risk?
The method: multi-source ingest, cross-source dedup, KEV/EPSS/CVSS enrichment, and npm-only blast radius. What it does and does not claim. Not legal advice.