Industries
Security choices need opposition, not another dashboard
Every security team works from a list longer than its hours. The real decisions concern order and acceptance: which exposure to close first, which control to buy, and which risk the business will knowingly carry until the next window.
Severity and risk are different questions
A severity score describes how bad a flaw would be if exploited. It says little about whether anyone is exploiting it, or whether the vulnerable code can be reached in your environment. Teams that patch strictly in severity order can spend weeks on findings no attacker can reach while a moderate flaw on an internet-facing system waits.
Better signals exist and are public. The Known Exploited Vulnerabilities catalog kept by the United States Cybersecurity and Infrastructure Security Agency lists flaws with evidence of exploitation in the wild. The Exploit Prediction Scoring System estimates the chance of exploitation over the following thirty days. Neither replaces knowing your own assets, but together they can reorder a queue.
Four honest treatments
Risk practice has long named four ways to treat a risk: reduce it, transfer it, avoid it, or accept it. Security plans often pretend only the first exists. Accepting a risk for ninety days, with a named owner and a compensating control, is a legitimate decision, and writing it down is far safer than leaving it as an unspoken backlog item.
On vendor decisions the common mistake is buying overlap. A new tool is easy to justify alone and hard to justify beside the three already licensed. The question that settles it is narrow: which specific attack path does this close that nothing in place closes now, and how would you know?
A remediation plan under challenge
The Decision lists the treatments side by side: patch this week under a change freeze, isolate the service, add a compensating control, or accept until the next maintenance window. The Champion for patching argues exposure. The Challenger presses on downtime and on the change that breaks a dependent system at two in the morning.
Scout looks for public exploitation evidence about the specific flaw. Inspector marks a scanner screenshot as evidence that a version is present, which is different from proof that the flaw is reachable. Red Teamer runs the scenario where the compensating control fails. When the record supports acceptance, the Verdict can favor it, and then it names the event, such as a public exploit, that would reverse it.
Records for the next question
Months later someone will ask why a known flaw stayed open, and the honest answer is usually a reasonable decision that nobody wrote down. A Decision Passport keeps the treatments considered, the evidence each rested on and the Human Decision, including who accepted the risk and until when. A saved version cannot be overwritten, which matters when the question arrives after an incident.
The room is not a scanner, an incident commander or an assurance that anything is secure. During an active incident, follow your response plan and examine the choices afterward. Argumont is for the slower decisions around it: what to fund, what to fix first and what to carry.
A flaw on a payment service
A scanner reports a critical flaw in a library used by a payment service. Exploitation has been reported publicly, but the vulnerable function is reachable only through an internal admin path behind the company login. Patching needs a release with an estimated six hours of downtime, in a week when the service expects $1.8 million in transactions a day, so about $450,000 of payments would be at risk. The options are an emergency patch, blocking the admin path at the gateway today and patching in the scheduled window nine days out, or accepting until then. The Verdict favors blocking the path and patching in the window, rests on the reachability evidence, and names the finding that would reverse it: proof that the function can be reached from outside.
Questions
- Can the room tell me whether a vulnerability is exploitable?
- It can gather public evidence about exploitation and mark what that evidence proves. Reachability in your own environment depends on testing your team performs, and the record keeps the two apart.
- Is accepting a risk ever the right Verdict?
- Often. When reducing a risk costs more than the exposure it removes and a compensating control holds, acceptance with an owner and an expiry date is a sound treatment. The Verdict states what would end that acceptance.
- Who signs a risk acceptance?
- Whoever your organization authorizes, usually the system owner or a security leader. That person's Human Decision is recorded apart from the Verdict, together with the date the acceptance runs out.
Bring Argumont a Decision worth challenging.
Start with a paid 60 day pilot on your own real Decisions.