Skip to content

Clear the vulnerability backlog

Fix the exposures that will actually be exploited.

A backlog of thousands isn't a prioritisation problem you can solve with a better spreadsheet. It needs ranking on real exploit signal, and it needs the fix written rather than described.

Click through VERA in the Demo Center →

The situation

What this usually looks like

If more than two of these are true, the work below is the work you are already doing by hand.

  1. The scanner produces more findings each month than the team can close.

    The backlog is a rate problem, and prioritisation alone doesn't change the rate.

  2. Everything critical by CVSS is critical, so nothing is.

    A severity everything shares stops being a ranking.

  3. The fix is described in a ticket and then written by hand, differently each time.

    The same work is re-solved every month and never accumulates.

  4. Nobody rolls anything back, because nobody recorded how.

    Change risk ends up managed by not changing anything.

The mechanism

See, decide, act, and then wait.

Four movements, in order. The fourth is the one that matters: nothing destructive happens without a person releasing it.

  1. 1

    See

    Every scanner, one queue

    Exposures are pulled from Nucleus Security, Qualys VMDR and CrowdStrike Spotlight, deduplicated, and enriched with CISA KEV membership, EPSS probability and asset context from the CMDB. A degraded feed marks its own records STALE instead of quietly serving old numbers.

    • Nucleus
    • Qualys VMDR
    • CrowdStrike Spotlight
    • CMDB
  2. 2

    Decide

    Ranked on what is actually exploited

    Known-exploited status, exploit probability, whether the asset is internet-facing, and how critical it is, banded Act, Attend or Track with an SLA tier of 2 hours, 24 hours, 7 days or 30 days. The queue orders by soonest breach, and every risk or confidence chip opens the factor breakdown that produced it.

    • KEV
    • EPSS
    • NET
    • Act / Attend / Track
  3. 3

    Act

    Authored as code, run by your orchestrator

    Exposures that share a fix cluster into a pattern, so one authored remediation covers many findings. The fix is written against your own patterns and executed on Kestra, canary first and then by ring, honouring change-freeze windows merged from ServiceNow and bounded by a computed blast radius.

    • Kestra
    • Canary then ring
    • Freeze windows
    • Blast radius
  4. 4

    Gate

    Autonomy is earned, and there is a kill switch

    A pattern graduates Manual, Assisted, Supervised, then Automated on its own track record, gated by a confidence bar per environment and severity. One approval covers a whole pattern group and binds the approver to the exact artifact SHA. A pulled kill switch shows who pulled it, when, and why, on every page.

    • Manual to Automated
    • Artifact SHA bound
    • Kill switch
    • Policy simulation

The gate

How the queue is banded

Priority bands rank the work and the SLA tier sets the clock. The flags say why: a Known Exploited Vulnerability, a high exploit probability, an internet-facing asset.

Refused

Act

Do it now. The live SLA board tracks this tier and the queue orders by whichever breaches soonest.

The rule2-hour and 24-hour tiers.

Waits for a person

Attend

Soon. Scheduled against a change window, not forced into one.

The rule7-day tier.

Logged only

Track

Watched, and recorded with its factors, so the decision not to act yet is also on the record.

The rule30-day tier.

Where autonomy has not been earned for a pattern, nothing executes without an approval bound to the artifact. Where it has, the rollout is still canary-first, freeze-aware and blast-radius bounded.

Who does the work

One agent owns this end to end.

You can turn one on and add the others later. A connector configured for one is available to the rest.

  • Protect and Harden

    VERA Vulnerability Remediation

    Ranks exposures on real exploit signal, writes the remediation as code against your own patterns, and drives it through your orchestrator reversibly.

    Full VERA detail →Take the tour

Also named in this outcome

Coming soon

Network Policy Analyzer

Firewall rule analysis, segmentation review, and access-policy conflict detection.

Questions

The things people ask first.

  • Will it patch production on its own?

    Only where that pattern has earned it. Autonomy is set per environment and severity with a confidence bar gating the maximum mode, and a pattern moves from Manual up to Automated on its own track record. Even fully automated, rollout is canary first, honours your freeze windows, and stays inside a computed blast radius.

  • How is the ranking different from CVSS?

    CVSS severity isn't the ranking. Whether the CVE sits in CISA's Known Exploited Vulnerabilities catalogue, its EPSS exploit probability, whether the asset is internet-facing, and how critical that asset is, are what set the band and the SLA tier. Every number opens the factors that produced it.

  • What does fix-as-code mean in practice?

    The remediation is authored as an artifact and executed by Kestra, with Semaphore and GitHub in the loop for commits and pull requests. Exposures sharing a fix cluster into a pattern, so the authoring happens once and covers the cluster.

  • Who approves, and what exactly are they approving?

    One approval covers the whole pattern group, not each finding, and the approver's identity is bound to the exact artifact SHA, so what was reviewed is provably what runs.

  • What happens if a feed breaks?

    Records backed by a degraded feed are marked STALE until it recovers, so a stale number is never mistaken for a fresh one. Connector health is treated as the root cause of context staleness, not a separate dashboard nobody opens.

The other outcomes