Vulnerability Triage
Vulnerability triage is the process of reviewing security findings to determine which are genuine, how severe they are, and which to fix first — filtering out false positives and ranking real issues by exploitability, reachability, and business impact.
Vulnerability triage is the step between detection and remediation. Scanners typically produce more findings than a team can fix immediately, and some findings are false positives or not exploitable in context. Triage sorts this list: confirming whether each finding is real, assessing its severity, and deciding the order in which issues should be addressed.
Good triage combines several signals rather than relying on raw severity alone. It considers the base severity (often a CVSS score), the likelihood of exploitation in the wild (such as the EPSS probability from FIRST), whether a vulnerability is on a known-exploited list (like CISA KEV), and whether the vulnerable code is actually reachable and used by the application. Combining these produces a ranked, actionable queue.
Triage matters because it directs limited engineering time to the vulnerabilities that pose real risk, instead of treating a long undifferentiated list as equally urgent. Effective triage reduces alert fatigue, prevents critical issues from being buried under noise, and is the foundation that risk-scoring approaches build on to automate prioritization.