DefectDojo

Vulnerability Management SLAs: Design, Enforcement, and Rollout Without Burnout

The SLA layer of a working VMP: Critical/High/Medium/Low durations, the automation that creates tickets and enforces the clock, the exception process, and the rollout approach that avoids engineering burnout in environments with heavy technical debt.

Vulnerability Scanner Architecture: What to Scan, How to Dedupe, When to Build

The scanner-architecture decisions behind a working vulnerability management program built without enterprise tooling — coverage, deduplication, enrichment, and the one scanner I ended up building myself.