Triaging Vulnerabilities: How Product Security Turns Scanner Findings into Risk Decisions

The article argues that a high CVSS score or scanner alert alone does not establish real product risk, and that the analysis must continue beyond the tool output. It describes a triage sequence that checks whether a finding applies to the product, whether the vulnerable path is reachable, how exploitable it is, and what an attacker could gain and reach next. The author stresses that business impact, blast radius, and available compensating controls should shape the response, rather than severity alone. The piece is aimed at AppSec newcomers, senior engineers who own risk decisions, and leads who need a repeatable vulnerability-management process. It frames the workflow as a reasoning model that should be adapted to each team's stack and environment.