For teams
Security teams need treatments, not only findings
A finding is a fact about a system. The decision is what to do about it: fix it now, contain it, accept it for a time, or stop the service. Security teams own that choice more often than the rest of the business realizes, usually with incomplete information and a change freeze around the corner.
Severity and risk are different questions
CVSS describes how bad a flaw is in general. The score says nothing about whether the vulnerable code runs on your checkout path or on a test server no one can reach. Two public signals help: the CISA Known Exploited Vulnerabilities catalog, which lists flaws seen exploited in the wild, and EPSS, which estimates the chance of exploitation in the next thirty days.
Reachability, exposure, and the data behind the service are your own evidence. They usually matter more than any score.
The four treatments
Risk practice names four responses: reduce the risk, avoid it by stopping the activity, transfer it, or accept it. Patching is only one way to reduce. An edge rule, a feature flag, or isolating the service can buy days while the patch is tested.
Acceptance is a legitimate treatment when it is explicit. It should carry a named owner, a written reason, and an expiry date, after which the risk returns for review.
The cost of fixing in a hurry
An emergency patch can break the thing it protects. Outage minutes, rollback risk, and the engineers pulled off planned work belong in the comparison as plainly as the threat does. A team that cannot show those costs tends to lose the argument to whoever is loudest that week.
A remediation in a Decision Room
Each treatment gets its own Champion: patch tonight, contain and patch in the window, or accept until then. The Challenger presses on the exploit claim and asks whether the vulnerable path is truly reachable. Scout gathers public advisories and exploit reports, and Inspector marks which of them prove anything about your exposure. Red Teamer runs the attacks the containment would have to survive.
The Verdict records which treatment leads and the condition that would change it, such as a working public exploit appearing. A favorable Verdict is a record of reasoning, never a statement that the system is safe.
One flaw, two hosts
A critical flaw appears in a library used by two services. On the public checkout service the flaw is reachable and already on the known exploited list. On an internal reporting host it is reachable only from a management network. For checkout, the options are an emergency patch tonight, a blocking rule at the edge now with the patch in Thursday's window, or waiting for the window. The team puts tonight's outage risk at 40 minutes, and checkout takes $18,000 an hour, so about $12,000 if it happens. The Verdict favors the edge rule now and the Thursday patch, provided a test confirms the rule blocks the published exploit; if the test fails, tonight's patch leads. For the internal host, the Verdict favors accepting the risk for thirty days, signed by the service owner, with the expiry date on the record.
Questions
- Can this stand in for a pentest or a scanner?
- No. Those find and confirm problems. The room helps decide what to do about a problem once you know it exists.
- Who owns an accepted risk?
- A named person with authority over the service. Their Human Decision, including the expiry date, is recorded beside the Verdict and the approvals in the Decision Passport.
Further reading
Bring Argumont a Decision worth challenging.
Start with a paid 60 day pilot on your own real Decisions.