Field Notes
What a CVSS-sorted backlog costs
Patching is the cheap part of vulnerability management. The cost is in what happens around a queue sorted by the wrong number. I count four costs.
The first is time. Your best engineers spend the week on theoretical criticals while an exploited high sits open. Nobody is slacking. They're working the list in the order it was handed to them.
The second is the word "critical". Once the list is full of them, it stops meaning anything, and nothing feels urgent until something becomes an incident.
The third shows up when leadership asks whether you're exposed. The honest answer is a spreadsheet. A count of open findings by severity doesn't tell anyone whether the flaws attackers are using have been closed.
The fourth shows up at audit. An auditor asks why you fixed things in that order, and there's no written reason. The scanner sorted it that way, and nobody decided it should.
A better scanner won't fix it
Tenable, Qualys and Rapid7 can all run perfectly and you can still drown, because the scanner stops at the point where you have to decide what to fix first and defend that decision.
That decision layer is a policy, a prioritization model, deadlines, an exceptions process and reporting. Most teams don't have one, and building it from scratch takes months.
I wrote down the program I ran and published it as the VM Program Kit. It's free, and there's no sign-up.