Vulnerability Management

Vulnerability Prioritization Beyond CVSS: The Rules-Based Model I Actually Use

Why CVSS on its own produces the wrong queue, and the rules-based prioritization model I use to turn CVSS + EPSS + context tags into a Critical/High/Medium/Low tier that engineering can actually work.

Vulnerability Scanner Architecture: What to Scan, How to Dedupe, When to Build

The scanner-architecture decisions behind a working vulnerability management program built without enterprise tooling — coverage, deduplication, enrichment, and the one scanner I ended up building myself.