Global Manufacturer Turns a 14,000-Item Vulnerability Backlog into a Working Queue

The challenge

Scanning covered the IT estate and the plant-adjacent networks thoroughly, and the resulting backlog had grown past fourteen thousand open findings. Ranked by CVSS base score alone, the queue offered no way to tell an unauthenticated internet-facing weakness from a critical rating on a segmented internal service, and remediation capacity was being spent close to randomly.

Our approach

Findings were re-ranked against three signals the base score does not carry: whether an attacker could actually reach the component, whether working exploit code existed and was being used, and what compromise of the component would grant access to. In parallel we agreed a remediation budget per engineering team per quarter, so security work was planned against real throughput instead of being requested against none.