Vulnerability triage
A stream of vulnerability reports with no method produces panic or paralysis:
everything feels urgent, so nothing gets a real deadline. The cure is to score
every report by the same rule, convert the score into a due date, and answer the
reporter on a schedule they can predict.
Method
- Reproduce before you rate. Close duplicates and non-issues fast. For the
rest, capture the affected version, the attack prerequisites, and a minimal
reproduction, so the score rests on facts and not on the reporter's
adjectives.
- Score with CVSS 3.1 and keep the vector string. Compute the base score
from 0 to 10 and store the full vector (AV, AC, PR, UI, and the rest) so
anyone can audit the rating later. Apply environmental metrics when your
deployment differs from the generic assumption.
- Convert the score into a fix window. Critical (9.0 to 10.0) inside 7
days, High (7.0 to 8.9) inside 30, Medium (4.0 to 6.9) inside 90, Low into
the next planned release. Start the clock at triage, not at the fix.
- Weight by real exploitability, not the base number. A Medium with a
public exploit or active use in the wild (check the CISA KEV catalog) jumps
the line. Internet-reachable and unauthenticated outranks a bug that sits
behind admin login.
- Track every report in one system with named states: reported, triaged,
fixed, verified, disclosed. Assign an owner to each finding, because a
vulnerability nobody owns is a vulnerability nobody is fixing.
- Disclose on a stated timeline. Acknowledge the reporter inside a fixed
window, agree an embargo (90 days is common), request a CVE, and publish an
advisory naming affected and fixed versions when the patch ships.
- Verify the class is closed, not just the case. Re-run the original
reproduction and its obvious variants, then land a regression test so
the same bug cannot quietly return two releases later.
Signals
- Does every open report carry a CVSS vector, an owner, and a due date?
- Is any Critical past its 7-day window with no explicit escalation on record?
- Could you produce the advisory and CVE for the last vulnerability you shipped
a fix for?
Boundaries
CVSS rates technical severity, not business impact: a low-scored bug on a
crown-jewel system can still deserve the front of the queue, and that call is
human. Legal and communications own the public wording of a major incident.
This skill gets the fix scheduled and the facts straight.
1---2name: vulnerability-triage3description: Score incoming vulnerability reports the same way every time, tie each score to a fix deadline, and run disclosure on a predictable clock. Use when a vulnerability report arrives or when standing up a process to handle them.4---56# Vulnerability triage78A stream of vulnerability reports with no method produces panic or paralysis:9everything feels urgent, so nothing gets a real deadline. The cure is to score10every report by the same rule, convert the score into a due date, and answer the11reporter on a schedule they can predict.1213## Method14151. **Reproduce before you rate.** Close duplicates and non-issues fast. For the16 rest, capture the affected version, the attack prerequisites, and a minimal17 reproduction, so the score rests on facts and not on the reporter's18 adjectives.192. **Score with CVSS 3.1 and keep the vector string.** Compute the base score20 from 0 to 10 and store the full vector (AV, AC, PR, UI, and the rest) so21 anyone can audit the rating later. Apply environmental metrics when your22 deployment differs from the generic assumption.233. **Convert the score into a fix window.** Critical (9.0 to 10.0) inside 724 days, High (7.0 to 8.9) inside 30, Medium (4.0 to 6.9) inside 90, Low into25 the next planned release. Start the clock at triage, not at the fix.264. **Weight by real exploitability, not the base number.** A Medium with a27 public exploit or active use in the wild (check the CISA KEV catalog) jumps28 the line. Internet-reachable and unauthenticated outranks a bug that sits29 behind admin login.305. **Track every report in one system** with named states: reported, triaged,31 fixed, verified, disclosed. Assign an owner to each finding, because a32 vulnerability nobody owns is a vulnerability nobody is fixing.336. **Disclose on a stated timeline.** Acknowledge the reporter inside a fixed34 window, agree an embargo (90 days is common), request a CVE, and publish an35 advisory naming affected and fixed versions when the patch ships.367. **Verify the class is closed, not just the case.** Re-run the original37 reproduction and its obvious variants, then land a regression test so38 the same bug cannot quietly return two releases later.3940## Signals4142- Does every open report carry a CVSS vector, an owner, and a due date?43- Is any Critical past its 7-day window with no explicit escalation on record?44- Could you produce the advisory and CVE for the last vulnerability you shipped45 a fix for?4647## Boundaries4849CVSS rates technical severity, not business impact: a low-scored bug on a50crown-jewel system can still deserve the front of the queue, and that call is51human. Legal and communications own the public wording of a major incident.52This skill gets the fix scheduled and the facts straight.
Amey-Thakur