Risk-based vulnerability management
Vulnerability management articles
Reachability and exposure before severity counts, ownership derived from the graph, and closure by evidence.
Risk-based vulnerability management ranks findings by whether they are reachable and exposed, not by CVSS alone, and routes each one to the team that owns it. These articles cover reachability-based prioritisation and ownership routing through the code-to-cloud graph.
- Scanner coverage: account for missing scan runsReview scanner coverage against expected assets, completed runs and evidence freshness, so a quiet findings queue does not conceal missing assessments. · Sujan Singh
- Vulnerability exceptions: review what changedReview vulnerability exceptions against changed assets, exposure and evidence, so a temporary acceptance does not quietly become permanent closure. · Sujan Singh
- Vulnerability ownership: make team handoffs explicitMake vulnerability ownership transfers explicit, with acceptance criteria, escalation and retained evidence so security work survives team changes. · Sujan Singh
- Vulnerability remediation: prove the fix is liveVerify vulnerability remediation from source change to deployed artefact, with clear closure criteria for rescans, rollout gaps and temporary mitigation. · Sujan Singh
- Risk-based vulnerability management: rank by reachabilityRisk-based vulnerability management ranks findings by reachability and exposure, turning a thousand CVSS criticals into a short list worth fixing now. · Sujan Singh
- Vulnerability ownership: route findings by the graphVulnerability ownership belongs in the graph, not a spreadsheet. Route each finding to the team that can fix it and close it on scan evidence. · Sujan Singh
See it on your stack
See connected security in action.
Explore the workflow with your engineering, security and compliance teams. No repository access is needed for the initial demonstration.