CVE Triage Playbook

$29

A decision framework + executable scorer to turn a wall of dependency-scanner CVE alerts into a ranked, defensible P0-P3 action list based on your deployment's real risk.

📁 6 files🏷 v1.0.0 (updated 2026-08-02)

PythonMarkdownJSON

📄 Product Preview

Try the interactive reader and demo tools below, or get the full product with all content unlocked.

📖 Interactive Reader (Free Preview) 📦 Download Free Sample

📁 File Structure 6 files

cve-triage-playbook/ ├── README.md ├── SEVERITY-RUBRIC.md ├── TRIAGE-FRAMEWORK.md └── examples/ ├── triage-log.md └── triage.py

📖 Documentation Preview README excerpt

CVE Triage Playbook

A decision framework for turning a wall of dependency-scanner alerts into a

ranked, defensible action list. When a scanner (Dependabot, Trivy, Snyk, `npm

audit, pip-audit`) reports 60 "critical" CVEs, most are noise for your app —

this playbook tells you which ones actually matter, in what order, and why.

The problem it solves

Automated scanners over-report. A CVE marked "critical" by CVSS may be

unreachable in your code, gated behind auth, or in a dev-only dependency. Teams

either drown (fix everything, break prod) or freeze (ignore all, get breached).

This playbook gives you a repeatable triage that a human — or an agent doing a

security pass — can apply in minutes per finding.

What's inside

TRIAGE-FRAMEWORK.md — the 6-question decision tree (reachability, exposure,

exploit maturity, data sensitivity, fix cost, blast radius) with a scoring rubric.

SEVERITY-RUBRIC.md — how to re-score a raw CVSS into an environmental priority

(P0/P1/P2/P3) for your actual deployment, with worked examples.

examples/triage-log.md — 8 real-shaped worked examples (Log4Shell-class RCE,

a transitive dev-dep, an unreachable path, a DoS behind auth) showing the

reasoning end to end.

examples/triage.py — a tiny, dependency-free scorer that takes the 6 answers

and outputs a P-level + recommended SLA, so the framework is executable.

How to use it (5 steps)

1. Export scanner findings to a list.

2. For each, answer the 6 triage questions (TRIAGE-FRAMEWORK.md).

3. Run triage.py (or score by hand) to get a P-level.

4. Sort by P-level; assign SLAs (P0 now, P1 this week, P2 this sprint, P3 backlog).

5. Record the decision in a triage log so "won't fix" is defensible at audit time.

Requirements

None to read/apply. triage.py needs Python 3.8+ (standard library only).

Who this is for

Engineers and security reviewers who own a service's dependencies, and agents

performing an automated security triage that must produce ranked, justified

output instead of "here are 60 criticals."

License

MIT. Copy the framework into your own runbooks and CI.

📄 Code Sample .py preview

examples/triage.py#!/usr/bin/env python3 """ CVE triage scorer — turns the 6 triage answers into an environmental priority. No dependencies. Use standalone or import score() into your own pipeline. python3 triage.py # runs the built-in examples python3 triage.py --interactive """ from __future__ import annotations import sys from dataclasses import dataclass # Points per answer (see TRIAGE-FRAMEWORK.md). REACHABILITY = {"none": 0, "build": 1, "runtime": 3} EXPOSURE = {"internal": 0, "authed": 1, "public": 3} EXPLOIT = {"theoretical": 0, "poc": 1, "weaponized": 3} DATA = {"none": 0, "limited": 3 - 2, "sensitive": 3} # 0, 1, 3 BLAST = {"single": 0, "service": 1, "cross": 3} @dataclass class Finding: cve: str reachability: str exposure: str exploit: str data: str blast: str fix_cost: str = "moderate" # trivial | moderate | expensive def score(f: Finding) -> tuple[int, str, str]: """Return (points 0-15, priority P0-P3, recommended SLA).""" pts = ( REACHABILITY[f.reachability] + EXPOSURE[f.exposure] + EXPLOIT[f.exploit] + DATA[f.data]

Buy Now — $29 Back to Products