Question

A security operations team runs monthly authenticated vulnerability scans across 12,000 hosts. The latest report lists over 40,000 findings, including 3,200 rated 'Critical' by CVSS base score. Leadership demands the team reduce actual exploitation risk quickly, but patch windows and staff capacity are limited. Which approach will most effectively prioritize remediation to reduce real-world exploitation risk?

Accepted Answer

Correlate findings with EPSS scores, known-exploited (KEV) status, and asset exposure/business criticality to rank remediation

Answer

Remediate strictly in descending CVSS base score order until the patch window is exhausted

Answer

Focus only on internet-facing hosts and defer all internal findings to the next quarterly cycle

Answer

Re-run the scans with credentialed plugins disabled to reduce the finding count to a manageable list