04 - Vulnerability Triage and SLAs

vulnerability-triage-and-slas', 'appsec', 'security', 'compliance']

04 - Vulnerability Triage and SLAs

Finding vulnerabilities is only half the battle; fixing them in a timely manner is the true test of a DevSecOps program. Without a structured triage and SLA process, development teams will drown in alert fatigue.

Risk-Based Triage with CVSS v4.0

The Common Vulnerability Scoring System (CVSS) is the industry standard for assessing the severity of a vulnerability. CVSS v4.0 introduces improved metrics, focusing on:

• Base Metrics: The intrinsic qualities of a vulnerability.
• Threat Metrics (formerly Temporal): Whether there is a known exploit (Exploit Code Maturity).
• Environmental Metrics: How the vulnerability affects your specific environment (e.g., is the vulnerable system exposed to the internet?).

Triage Workflow

1. Automated Detection: Scanner finds a vulnerability (e.g., Base CVSS 8.5 - High).
2. Contextualization (EPSS / Threat Intel): Determine if the vulnerability is actually exploitable in the wild. If it is sitting behind a WAF or on an internal isolated network, the effective risk is lower.
3. Prioritization: Adjust the score based on business context.

Vulnerability SLAs (Service Level Agreements)

SLAs define the maximum amount of time a development team has to remediate a vulnerability based on its severity.

Standard Industry SLA Matrix

Severity	CVSS v4.0 Score	Remediation SLA	Definition
Critical	9.0 - 10.0	7 Days	Vulnerabilities that are actively being exploited in the wild, or lead to immediate remote code execution / data breach.
High	7.0 - 8.9	30 Days	Vulnerabilities with high impact but may require authentication or complex prerequisites to exploit.
Medium	4.0 - 6.9	90 Days	Issues that have moderate impact, often requiring user interaction (e.g., Stored XSS).
Low	0.1 - 3.9	Best Effort	Informational issues or defense-in-depth findings without direct exploitation vectors.

Developer Remediation Workflows

To enforce SLAs without causing friction:

• Jira / Ticket Integration: Automatically create tickets for High/Critical findings.
• Actionable Guidance: Do not just send a PDF report. Provide the exact line of code, the CVE ID, and a suggested fix (e.g., "Bump dependency lodash to version 4.17.21").
• Exception Process: If a fix will take longer than the SLA, require a formal Risk Acceptance process signed off by the engineering director and CISO.

[!TIP] Pro Tip: Always automate your security and compliance checks early in the pipeline to reduce manual overhead and ensure continuous compliance.