eCPPT: Vulnerability discovery, severity and verification

This domain tests whether you can turn a scanner report into a defensible remediation plan. It separates discovery, prioritisation and verification, and expects you to know the scoring systems and their limits.

Process

1. Inventory assets and assign business criticality (data class, exposure, dependency).
2. Scan - authenticated scans give far better coverage than unauthenticated ones; schedule to avoid production impact; include containers, cloud services and network devices.
3. Validate findings and separate false positives from real issues.
4. Prioritise using severity, exploitability, exposure and business impact together.
5. Remediate by patch, upgrade, configuration change, compensating control, or documented acceptance.
6. Verify by rescan and close the ticket; track exceptions with an owner and an expiry date.

Scoring and intelligence

CVSS v 3.1 base score (0–10) uses attack vector, complexity, privileges required, user interaction, scope and CIA impacts. It measures severity, not organisational risk: a 9.8 on an isolated test box can matter less than a 7.5 on an internet-facing payment server. EPSS estimates the probability of exploitation in the wild, and the CISA KEV list identifies vulnerabilities known to be exploited - those jump the queue. Use the CVSS version and metric groups actually specified; do not confuse a technical severity score with complete organizational risk.

Scanning versus testing

Vulnerability scanning is broad, automated and recurring. Penetration testing is targeted, manual, time-boxed and validates exploit chains; it complements rather than replaces scanning. Responsible disclosure and bug bounty programmes give external researchers a channel. Never test without written authorisation and a defined scope.

Worked example

Two findings: CVSS 9.8 on an internal build server with no internet route, and CVSS 7.2 on the internet-facing VPN concentrator that appears in KEV. The VPN is fixed first - known exploitation plus exposure outweighs the nominal score. The build server is patched in the next cycle, with a temporary network rule as a compensating control.

Traps

• Sorting by CVSS alone and ignoring exposure and known exploitation.
• Assuming an unauthenticated scan found everything.
• Closing a ticket without a verification rescan.
• Leaving risk acceptances open-ended with no owner or expiry.