Vulnerability Management That Scales With a Small Team

The firehose problem

A modern scanner will hand a 20-person company tens of thousands of findings. Treating them as a flat to-do list guarantees failure: the team burns out, nothing gets prioritized, and the genuinely dangerous vulnerabilities hide in the noise.

Prioritize by exploitability, not just severity

CVSS scores are a starting point, not an answer. A "critical" on an internal box with no network path is less urgent than a "medium" on an internet-facing service with a known exploit.

Is it reachable? Internet-facing beats internal beats air-gapped.
Is it being exploited? Cross-reference CISA's KEV catalog and EPSS scores.
What does it protect? A vuln on the database with customer PII outranks one on the marketing CMS.

Set SLAs and mean them

Actively exploited, internet-facing: 72 hours.
Critical, reachable: 7 days.
High: 30 days.
Everything else: quarterly batch.

Publish the SLAs, track aging, and report breaches up the chain. An SLA nobody measures is a wish.

Close the loop

Patching isn't done until you've re-scanned and confirmed. Track three numbers: open count, mean time to remediate, and SLA-breach rate. If MTTR is climbing, you have a capacity problem, not a tooling problem.

The goal isn't zero vulnerabilities — that's impossible. It's a predictable, shrinking backlog with the dangerous ones always at the top.

Vulnerability Management That Scales With a Small Team

The firehose problem

Prioritize by exploitability, not just severity

Set SLAs and mean them

Close the loop

See Hosting Security in action

Related articles

Prompt Injection and Securing the AI Features You Ship: A Field Guide for Small Teams Building With LLMs

Scoping a Penetration Test: Rules of Engagement That Get You a Useful Report Instead of an Expensive One

CVSS, EPSS, and KEV: Prioritizing Vulnerabilities by What Gets Exploited

Related articles

Vulnerabilities
Prompt Injection and Securing the AI Features You Ship: A Field Guide for Small Teams Building With LLMs
The moment your product calls a large language model, you have shipped a new and genuinely strange class of vulnerability — one where the attacker writes instructions in plain English and the model cannot reliably tell them apart from your own. This is not the risk of employees pasting data into chatbots; it is the risk of the AI features you build. A grounded walk through prompt injection, why the model confuses instructions with data, why giving the model tools turns a clever trick into real damage, and the controls that actually contain it.

Vulnerabilities
Scoping a Penetration Test: Rules of Engagement That Get You a Useful Report Instead of an Expensive One
A penetration test is only as good as the conversation you have before it starts. Vague scope and missing rules of engagement are how teams end up paying for a report that tests the wrong things, misses what they actually needed, or — worse — takes down production. This is the pre-engagement discipline: defining scope, objectives, rules of engagement, and the authorization that separates a sanctioned test from a crime, so the money buys real assurance.

Vulnerabilities
CVSS, EPSS, and KEV: Prioritizing Vulnerabilities by What Gets Exploited
A CVSS score tells you how bad a flaw could be in theory, not whether anyone is actually attacking it. How EPSS and CISA KEV add exploitation reality to severity, so a small team patches the handful of findings that genuinely matter first.