Decision Library
Fix what an attacker can reach, then everything else
A security team always has more findings than hours. The hard decision is order: what to patch tonight, what to isolate, what to accept until the next maintenance window, and how to explain that choice afterward. A Decision Room compares those options on how exposed each weakness is, what it would cost if used, and what the fix itself would disrupt.
Argumont is decision support. It is not a penetration test, a security assessment, or incident response.
The options for each finding
Patch now, with whatever outage or freeze that requires. Isolate the asset by narrowing who can reach it. Add a compensating control, such as a filtering rule in front of the application or closer monitoring. Accept the risk for a stated period with a named owner. Retire the system altogether.
Acceptance belongs on the list. When it is left off, teams accept risk anyway, only silently and without a date to revisit it.
Severity is different from likelihood
The Common Vulnerability Scoring System, maintained by the incident response forum FIRST, rates how severe a flaw would be if exploited. It says little about whether anyone will exploit it. FIRST also publishes the Exploit Prediction Scoring System, which estimates the probability that a published flaw will be exploited in the next 30 days, and the United States Cybersecurity and Infrastructure Security Agency keeps a catalog of vulnerabilities known to be exploited in the wild.
Those sources answer different questions. Combined with your own knowledge of which assets face the internet and which hold sensitive data, they turn a long list sorted by color into a short list sorted by consequence.
Evidence that settles priority
Reachability from untrusted networks, proof that the vulnerable code path is actually used, the data or money the asset touches, whether detection would catch misuse, and the true cost of the fix in downtime and engineering hours. A scanner screenshot proves that a version string matched. Only testing or code review shows the weakness can be used here.
How the room argues remediation
Each option gets a Champion, so acceptance and isolation are argued as seriously as the emergency patch. The Red Teamer walks the path an intruder would take from the internet to the asset. The Inspector checks whether the evidence proves reachability or only suggests it, and the Craftsman tests whether the fix fits the change window without breaking the release. The Gray Wolf names the residual risk each option leaves behind.
The Verdict orders the options, states what remains exposed under each, and names the fact that would reorder them, such as public exploit code appearing. The security lead records the Human Decision, including any acceptance and its expiry date.
What to weigh
Exposure
How reachable the asset is from untrusted networks, and by which paths.
Exploitation evidence
Whether the flaw appears in the known-exploited catalog or has public exploit code.
Impact
The data, money or operations an attacker would reach through this weakness.
Detection
Whether monitoring would notice misuse quickly enough to act.
Fix disruption
Downtime, freeze-window conflicts and regression risk the remediation brings.
Residual risk
What remains exposed after the chosen option, and for how long.
Where it goes wrong
Change-induced outage
The rushed fix takes down more revenue than the finding ever threatened.
Paper control
A compensating control exists in the policy document but was never deployed or tested.
Silent acceptance
Risk is accepted by delay, with no owner, record or review date.
Two findings, one change window
A retailer's scan reports a critical flaw scored 9.8 on an internal reporting server and a medium flaw scored 6.5 in the public payment service. The reporting server sits on a segment no internet traffic can reach. The payment flaw appears in the known-exploited catalog, and the service processes about $40,000 an hour in orders. Patching it needs a 90-minute outage, roughly $60,000 in delayed orders, while a filtering rule could block the exploit path tonight at little cost. The room weighs exposure 30, exploitation evidence 25, impact 20, fix disruption 15 and detection 10. The Verdict leads with the filtering rule tonight and the payment patch in Sunday's low-traffic window, with the critical internal flaw kept in the regular cycle, and it names what would change that order: any sign of access to the internal segment.
Questions
- Can I paste scanner output?
- Yes. Paste the findings and say which assets face the internet and what data they hold. The room separates what the scanner proved from what it assumed and orders the work accordingly.
- Is a Verdict the same as a security assessment?
- No. A Verdict is a reasoned comparison of options from the evidence you provide. Testing, incident response and the Human Decision stay with your security team.
Bring Argumont a Decision worth challenging.
Start with a paid 60 day pilot on your own real Decisions.