Vulnerability Management in Production
Prioritizing and remediating risks already in operation
Despite the best shift-left efforts, no AppSec program completely eliminates the risk of a vulnerability reaching production, whether because it was introduced before certain controls were implemented, because a new vulnerability appears in an already deployed dependency, or because an external researcher reports it through a bug bounty program. Managing vulnerabilities in production requires a clear, agile triage process, where each finding is quickly assessed for real severity, considering not just the generic technical score but factors specific to the context, such as whether the affected component is reachable from the internet or whether a public exploit already exists for that specific vulnerability. A common mistake is treating all vulnerabilities with the same level of urgency, which exhausts the team's capacity and ends up delaying the fix for the ones that really matter; effective prioritization is based on the real combined risk of exploitability and impact, not just the severity reported by the scanning tool. Equally important is keeping a historical record of these vulnerabilities and their remediation time, because that data directly feeds the program's maturity metrics and reveals systemic patterns that warrant a root-cause fix, not just a one-off patch.