Forty Findings, One Afternoon

Everything is 'high'. Decide what actually gets fixed first.

Your scanner produced forty findings and labelled most of them 'high'. You have one afternoon and one engineer. This exercise is about the step nobody teaches: turning a severity-sorted dump into a defensible priority order using exposure, exploitation evidence, and business context — the approach set out in Integrating Threat Intelligence. Read the scanner output, the exploitation feed, and the asset inventory together, because none of them is sufficient alone.

Fictional training scenario. All output is synthetic. CVE identifiers shown are illustrative placeholders and do not refer to real advisories — the exercise is about the prioritization method, not about looking up specific vulnerabilities.

Your brief

You're the security engineer at Northwind. A nuclei scan of your external estate finished overnight, you have this week's exploitation feed, and you have the asset inventory that says what each host actually does. Your manager wants to know what gets fixed today. Read all three and decide.

$ nuclei -l live.txt -severity critical,high,medium -jsonl | jq -r '[.info.severity,.info.name,.host]|@tsv'

critical  Remote code execution in FreightRouter (CVE-2026-11001)   https://legacy-router.northwind.example
high      Outdated TLS configuration — TLS 1.0 enabled              https://marketing.northwind.example
high      Exposed .git directory                                    https://api.northwind.example
high      Authenticated RCE in AdminPanel (CVE-2026-11042)          https://admin.northwind.internal
high      Default credentials accepted                              https://printer-3f.northwind.internal
high      SQL injection in order lookup (CVE-2026-11077)            https://shop.northwind.example
medium    Missing security headers                                  https://www.northwind.example
medium    Directory listing enabled                                 https://cdn.northwind.example
medium    Verbose error messages                                    https://blog.northwind.example

Triage decisions5 questions · 70% to pass

1. Which finding gets fixed first?

Select one. · Evidence: , ,

2. The scan reports a critical RCE on legacy-router.northwind.example. What's the correct action?

Select one. · Evidence: ,

3. Which findings can reasonably wait? Select all that apply.

Select all that apply. · Evidence: ,

4. How should the internal-only findings (admin console RCE, printer default credentials) affect your ordering?

Select one. · Evidence: ,

5. Your manager asks why a 'high' is being fixed before a 'critical'. What's the defensible answer?

Select one. · Evidence: ,

0/5 answered

Defensive lessons

1Severity is an input, not an answer. CVSS describes a vulnerability in the abstract; your risk is exposure × confirmed exploitation × business impact. Sorting by severity alone produces a queue nobody can defend.
2Confirmed in-the-wild exploitation is the highest-value filter available, and it's free. Anything in your estate that appears on an exploitation feed goes to the top regardless of its severity label.
3Cross-reference findings against an asset inventory before acting. A 'critical' on a decommissioned host and a 'high' on your payment platform are not comparable, and only the inventory tells you which is which.
4A dangling DNS record is its own finding. Decommissioning isn't finished until the DNS record is gone, or someone else can claim the name and serve content from your domain.
5'Internal-only' lowers exposure without granting immunity. Rank internal findings below internet-facing ones, but keep admin consoles and RCE high — they're what an attacker reaches for after the first foothold.
6Exposed .git directories are credential leaks, not configuration nits. Source, config, and commit history frequently contain keys that outlive the code.
7Write the prioritization rule down. A documented, tunable formula survives the 'why is this ranked above that?' conversation. Intuition does not, and it can't be handed to the next person on call.