Triage scan reports that lead somewhere
Updated
Scanners report hundreds of findings; triage turns them into three lists: fix now, fix scheduled, accepted with a reason.
Vulnerability scanners are excellent at producing fear and terrible at producing plans. A raw report with hundreds of findings teaches teams to ignore all of it. Triage is the translation step: every finding ends in exactly one of three lists.
Three lists, no fourth pile
Fix now. Reachable, exploitable, on something that matters. Small list, short dates, daily check until empty.
Fix scheduled. Real but not urgent: interior services, theoretical paths, defense in depth. Each has an owner and a date, or it silently becomes accepted.
Accepted with a reason. False positive with evidence, or risk consciously carried. The reason is written, dated and re-checked on schedule. No reason, no acceptance.
Worked example: a fictional scan morning
The context below is fictional. Fictional team ParcelTrack (fictional) gets 240 findings on Monday. By noon they have 6 fix-now items (two internet-facing, four with known exploits), 40 scheduled with owners, and the rest accepted with evidence or scheduled re-checks. Friday: fix-now empty, scheduled moving, nobody burned out.
The habit that made it work: the same triage hour every week, same three lists, same rule that nothing sits unlisted.
Checklist: a scan that ends in action
- Every finding in exactly one list.
- Fix-now items ownable by Friday.
- Acceptances carry written reasons with re-check dates.
- Weekly triage hour on the calendar.
Related reading
- Hands on: Triage the Fixture Scan Report.
- Slim images shrink reports: Small, safe container images.
Straight answers
Frequently asked questions
Hundreds of findings. Where to start?
Reachable and exploitable first: internet-facing, running as root, with known exploits. Rank by exposure, not by score alone.
What about false positives?
Record the verdict with evidence and move on. An undocumented dismissal returns as the same panic next quarter.
Who owns the fix list?
Named owners per finding with dates. A shared list with no names is a list nobody reads.