The backlog problem
Most organisations do not lack scan results — they drown in them. Thousands of findings, rated by severity alone, land on teams that do not own the assets. The backlog grows and the riskiest issues hide among the noise.
Five building blocks
1. Know your assets
Scanning coverage is only as good as your inventory. Reconcile scanner targets with CMDB, cloud accounts and endpoint agents. Anything unknown is unpatched by definition.
2. Prioritise by real risk
Severity scores describe a vulnerability, not your exposure. Combine:
- Exploitability — is there known exploitation in the wild?
- Exposure — is the asset internet-facing?
- Business criticality — what does the asset support?
A medium-severity flaw being actively exploited on an internet-facing server outranks a critical one on an isolated lab machine.
3. Assign owners and SLAs
Every asset needs an owner who is accountable for remediation. Agree time-bound SLAs, for example:
| Priority | Target to remediate |
|---|---|
| Actively exploited, internet-facing | Days |
| Critical | 15 days |
| High | 30 days |
| Medium | 90 days |
4. Handle exceptions formally
Some fixes are not possible on time. Use a documented exception with compensating controls, a risk owner's approval and an expiry date.
5. Verify
Rescan to confirm fixes. Closing tickets without verification inflates success.
Metrics that matter to leadership
- Percentage of critical findings fixed within SLA
- Mean time to remediate by priority
- Number of overdue exceptions
- Coverage — percentage of assets scanned in the last 30 days
Avoid reporting raw finding counts; they rise with better coverage and confuse the message.
Beyond patching
Recurring findings point to process issues: insecure base images, missing configuration standards or no patch window. Fix the source and the backlog shrinks.
Key takeaways
- Prioritise by exploitability, exposure and business criticality, not severity alone.
- Every asset needs an owner and agreed remediation SLAs.
- Report SLA performance and coverage, not raw finding counts.
Frequently asked questions
What does risk-based prioritisation use?
Typically severity scores combined with threat intelligence on active exploitation, the asset's exposure and its importance to the business.
What if a patch cannot be applied?
Record a time-bound exception with compensating controls, such as isolation or additional monitoring, approved by the risk owner.
How do we measure success?
Track remediation within SLA, mean time to remediate, overdue exceptions and scan coverage over time.
The goal is not zero vulnerabilities. It is no unmanaged ones.
Our VAPT services include continuous scanning and remediation support.
