Field Notes

Notes on vulnerability management and risk-based prioritization, from the program I built and scaled across more than 5,000 applications.

September 15, 2026
Severity is not priority
CVSS tells you how bad a flaw could be in theory. It says nothing about whether anyone is turning it against you today. Here is the order I actually worked the queue in.