Documenting Unfixed Vulnerabilities Through Formal Risk Acceptance

Security professionals often face clients who decline to fix known vulnerabilities, for reasons such as legacy software, vendor patch limits, or costly downtime. The article argues that such decisions should be recorded through a formal risk acceptance document rather than left as unresolved findings that lose context over time. It recommends listing the affected systems, the reason a fix isn't feasible, the realistic consequences, and compensating controls, along with a named client decision owner and clear expiry and review dates. Acceptance usually involves cheaper protective measures like network segmentation, firewall restrictions, or added monitoring rather than doing nothing. Accepted risks should be tracked separately and reviewed periodically, with earlier reconsideration if threat indicators such as known exploitation or new exposure emerge.