Guides

A vendor-neutral map of VOC tool categories — inventory, scanners, cloud, containers, SCA, EASM, aggregation, ticketing — and how to choose and connect them.

How a VOC reports to executives and the board: audiences, a one-page structure, KRIs vs KPIs, trends over snapshots, and what to leave out.

Define and compute the metrics a VOC needs: time to remediate with percentiles, SLA compliance, coverage, backlog age, KEV exposure windows and reopen rate.

Run a vulnerability exception process that stays honest: exception types, approval by risk level, compensating controls, expiry and an auditable register.

An end-to-end remediation workflow: deduplicate findings, group them by fix, route to owners, integrate with ITSM, and close only on rescan evidence.

Design risk-based vulnerability remediation SLAs: tiers instead of raw CVSS, when the clock starts and pauses, escalation, and measuring compliance.

How Stakeholder-Specific Vulnerability Categorization (SSVC) works, how to evaluate each decision point, and how to map Track, Attend and Act to SLAs.

How to combine CVSS v4 severity, EPSS exploitation probability, the CISA KEV catalog and asset context into priority tiers teams can meet.

Design a scanning strategy for a VOC: authenticated scans, agents, cloud and container assessment, SCA, DAST, safe scanning and measurable coverage.