prioritization
8 posts · all writing
The one finding in 21,075 that attackers already use
Trivy on the 25 most-pulled Docker Official Images, run through Draugr: 21,075 findings, one on CISA's KEV list, 26 with an EPSS score of 0.5 or more, and 2,088 with a fix published.
Don't make the model rank it
Two findings arrive looking the same, and one is a leaked private key. Left to a model, the choice of which to fix first comes out differently every time.
The monorepo your scanner thinks is one app
One repository, many services, one number. Whose findings are these, which are urgent, and whose merges does a red build stop? None of it is in the code.
A misconfiguration has no CVSS, which is why nobody fixes it
A privileged pod and a public bucket have no CVE and no CVSS, so every IaC tool invents a severity and the breach sorts below an unreachable dependency.
Most of your container CVEs aren't yours
Scan a 35-line Python app and get 292 findings. 219 come from the base image, and none are fixable by changing your code. What the actionable move is.
Shift left became run everything on every commit
What got built was twelve scanners on every push, eleven minutes, and a pipeline people bypass. The useful version is about latency, not location.
You don't need twelve scanners, just the four that apply
Teams adopt security tooling as nothing or everything at once, and both fail because nobody decided which controls their software actually needs.
What to fix first when everything is critical
Severity is not priority. What matters depends on where a problem lives and what the business would lose, which is context a scanner cannot see.