How to triage vulnerabilities and track remediation
Map the vulnerability triage and remediation process as a flowchart, then count findings by source, severity and outcome and show them as a Sankey diagram. Illustrative method, not a compliance claim.
Triage decides which findings are real and how fast they must be fixed. This guide draws that process as a flowchart and then counts findings through it, so you can see how many are fixed on time, accepted or still open.
The short version
- Draw triage as decisions with named exits: confirmed, false positive, within SLA, exception.
- Count findings through the exits for one period, after removing duplicates.
- Show source, severity and outcome as a Sankey diagram to see the shape of the work.
- Treat accepted risk and open findings as results to explain, not failures to hide.
Triage is a set of decisions you can count
A scanner reports findings. A process decides what happens to them: is it a real finding on this asset, how severe is it, what is the deadline, can we meet it, and was the fix confirmed. Each of those is a decision with exits, and each exit has a number of findings. Drawn as a flowchart, the process is easy to review. Counted, it shows where findings pile up.
The example is a 26-step vulnerability management process. Its decisions are the same ones a Sankey needs as nodes: scannable or not, confirmed or false positive, exploited or routine, within SLA or not, closed or still present. The Sankey template at /sankey/vulnerability-remediation-flow shows one period's findings as source, severity and outcome.
This is a way of seeing your own records, not a statement about what any standard requires. Your policy defines the SLA bands and who may accept risk.
A vulnerability process, built in stages
Twenty-six steps. The decisions are where a finding can leave the main path, and each one is a count.
Scoping and scanning
The cycle starts from the asset inventory. "Every in-scope asset scannable?" has a Coverage gap branch that loops back until the asset can be scanned, so unscanned assets are visible as a count rather than as silence.
Confirming and scoring
Findings are de-duplicated and enriched, and "Finding confirmed on the asset?" sends false positives to a suppress step with evidence. Confirmed findings are scored. The false positive count is the first outcome to track.
Deadline, fix and exception
Known exploited or critical findings take an emergency track, and the rest get an SLA band and due date. "Remediable within the SLA?" sends findings that cannot meet it to an exception decision, and the rescan decides whether the fix worked.
Register and reporting
Closed findings update the register, overdue ones are escalated and the cycle ends with coverage, ageing and closure metrics. These are the counts you can bring together into one Sankey for the period.
How it works
Draw your triage process
Include the decisions: confirmed, severity, deadline, exception, fix confirmed. Name every exit.
Export a period of findings
Take the findings opened in one quarter from every scanner. Remove the same issue reported by two tools.
Group severity and outcome
Use four severity bands and a short list of outcomes: fixed in SLA, fixed late, accepted, false positive, open.
Count source to severity to outcome
Count each finding once. Check that what enters each severity equals what leaves it.
Read the exceptions first
Look at the accepted and open findings, and at the severities where they concentrate. Decide whether that matches your policy.
Mistakes to avoid
Counting the same issue twice
Two tools often report one vulnerability. Without de-duplication the sources look larger than they are.
Hiding accepted risk
Leaving accepted findings out makes the fixed share look higher. Show them as their own outcome.
Using the diagram as evidence
A Sankey of counts is a summary. Evidence for an audit is the underlying records, with dates and approvals.
Open the vulnerability management flowchart
Open the template, adapt the decisions to your policy and count the exits.
Related guides
Frequently asked questions
Can this show whether I meet a standard?
No. It shows your own counts. Whether they meet a standard depends on the standard and on your policy, which this guide does not set.
How do I count a finding that is on many assets?
Decide once: count each asset-finding pair, or each distinct vulnerability. Say which in the data note and keep it the same each period.
Should false positives be in the chart?
Yes, as an outcome. A high false positive share points at scanner tuning, which is a different fix from patching.