The SLA layer of a working VMP: Critical/High/Medium/Low durations, the automation that creates tickets and enforces the clock, the exception process, and the rollout approach that avoids engineering burnout in environments with heavy technical debt.
Why CVSS on its own produces the wrong queue, and the rules-based prioritization model I use to turn CVSS + EPSS + context tags into a Critical/High/Medium/Low tier that engineering can actually work.
The scanner-architecture decisions behind a working vulnerability management program built without enterprise tooling — coverage, deduplication, enrichment, and the one scanner I ended up building myself.
The design mistakes that quietly break vulnerability management programs — noise, ownership confusion, unrealistic SLAs, no shared accountability — and the shared-responsibility model that fixes them.