Prioritizing and Remediating Findings
Triage vulnerabilities by CVSS, exploitability, and business impact; write actionable remediation tickets.
The Prioritization Problem
A typical enterprise vulnerability scan returns thousands of findings. Without a systematic prioritization approach, teams either ignore them all or firefight randomly. Effective remediation starts with triage.
CVSS as a Starting Point
CVSS base score provides a vendor-neutral severity baseline. Start with Critical (9.0+) and High (7.0–8.9). But CVSS alone is insufficient — it does not account for your specific environment or exploitability.
# Filter by CVSS in Nessus:
# Vulnerabilities > Filter > CVSS >= 7.0
# In OpenVAS:
# Results > Filter > Severity >= HighAll lessons in this course
- CVE, CWE, and CVSS Scoring
- Running Nessus or OpenVAS Scans
- Web App Scanning with Nikto and OWASP ZAP
- Prioritizing and Remediating Findings