Florian Amette
Security engineer writing practical, vendor-neutral guidance on building and running vulnerability management programs and Vulnerability Operations Centers.
08 · Panorama de herramientas/EN
A vendor-neutral map of VOC tool categories — inventory, scanners, cloud, containers, SCA, EASM, aggregation, ticketing — and how to choose and connect them.
07 · Métricas e informes/EN
How a VOC reports to executives and the board: audiences, a one-page structure, KRIs vs KPIs, trends over snapshots, and what to leave out.
07 · Métricas e informes/EN
Define and compute the metrics a VOC needs: time to remediate with percentiles, SLA compliance, coverage, backlog age, KEV exposure windows and reopen rate.
06 · Excepciones y aceptación del riesgo/EN
Run a vulnerability exception process that stays honest: exception types, approval by risk level, compensating controls, expiry and an auditable register.
05 · Flujo de remediación/EN
An end-to-end remediation workflow: deduplicate findings, group them by fix, route to owners, integrate with ITSM, and close only on rescan evidence.
05 · Flujo de remediación/EN
Design risk-based vulnerability remediation SLAs: tiers instead of raw CVSS, when the clock starts and pauses, escalation, and measuring compliance.
04 · Priorización/EN
How Stakeholder-Specific Vulnerability Categorization (SSVC) works, how to evaluate each decision point, and how to map Track, Attend and Act to SLAs.
04 · Priorización/EN
How to combine CVSS v4 severity, EPSS exploitation probability, the CISA KEV catalog and asset context into priority tiers teams can meet.
03 · Estrategia de escaneo/EN
Design a scanning strategy for a VOC: authenticated scans, agents, cloud and container assessment, SCA, DAST, safe scanning and measurable coverage.
02 · Inventario de activos/EN
Build an asset inventory a VOC can rely on: data sources, reconciliation keys, ownership and criticality attributes, and measuring coverage gaps.
01 · Modelo operativo/EN
Who does what in a Vulnerability Operations Center: core roles, a full RACI across the lifecycle, and how the VOC works with the SOC, IT and developers.
01 · Modelo operativo/EN
What a Vulnerability Operations Center is, how it differs from a SOC or a scanning team, and how to charter, staff and run one step by step.