Question

Your security team faces a backlog of 400+ Dependabot alerts across a large service. Leadership wants a repeatable remediation prioritization approach that focuses engineering effort where the real-world risk is highest, rather than blindly working from raw CVSS base scores. Which prioritization approach best reflects GitHub Advanced Security best practices for reducing exploitable risk first?

Accepted Answer

Combine severity with exploit-likelihood and reachability signals — such as EPSS scores, whether the vulnerable function is actually called, and whether the dependency is runtime versus development — to rank alerts

Answer

Sort strictly by CVSS base score descending and remediate the highest-scoring CVEs first, ignoring other signals

Answer

Remediate alerts in the chronological order they were opened, oldest first, to clear the oldest technical debt

Answer

Prioritize by the number of transitive dependency levels away the vulnerability sits, fixing the deepest ones first