41,200 Findings, Three Engineers, and a Change Freeze

CVSS describes severity if exploited; it says nothing about reachability or whether someone is already exploiting it. Rank on reachable + exploited + uncontrolled.

1. VPN concentrator. Internet-facing, KEV-listed, EPSS 0.71, active exploitation of the same product elsewhere, and no compensating control - the WAF does not front it. CVSS 9.8 is almost incidental. Because it is an HA pair, patch one node out of hours, verify, then the other; that removes the reboot objection. Between maintenance windows, apply vendor mitigations, restrict management access to a jump host, enforce MFA on all remote access, and hunt for the vendor's published indicators.

2. ERP middleware (7.5). Lower score but inside the frozen estate, so it becomes a governance item rather than a patching item.

3. The 780 servers at 9.1. High severity, but local authentication is required and no public exploit exists. It still matters if an attacker obtains credentials, so pair normal-cycle patching with EDR coverage verification and east-west segmentation - but do not spend the freeze window's limited engineering capacity here while the VPN is open.

With 41,200 findings and three engineers, triage must be exposure-based or the backlog never moves.

A freeze is a schedule constraint, not a risk transfer. The correct action is a documented, time-boxed exception with tested compensating controls - not silence, and not an unauthorized patch.

Steps:

1. Open a risk exception citing the specific finding, affected hosts, and the freeze clause.
2. Name a risk owner - the ERP business owner, not the patch team.
3. Specify compensating controls and test them so the claim is evidenced: restrict who can reach the middleware port, front it with the WAF in blocking mode with a tuned rule, confirm EDR is in prevention mode on all affected hosts, restrict the service account, and add detection for exploitation attempts.
4. Set an expiry no later than the freeze lift and pre-book the change window for the day after, so the fix is not re-queued behind other work.
5. Obtain CISO sign-off against the risk appetite threshold; if residual stays High, escalate to the CFO per policy.
6. Log it in the risk register with a review date. Exceptions that roll over silently are what auditors - and plaintiffs - find.

Evidence to retain: scan output, control test results, approvals, the linked change ticket, and review notes. If that port is ever the entry point, this file is the difference between a documented decision and negligence.

Report risk-weighted remediation performance, not finding counts:

• Percentage of internet-facing and KEV-listed findings remediated inside SLA (target near 100%).
• Median time-to-remediate by exposure class: internet-facing, internal-high, internal-low.
• Open exceptions, and how many are past expiry.
• Scan coverage: the percentage of the 8,400 assets with a successful authenticated scan in the last 30 days. If coverage is 70%, the finding count is also an undercount.

Raw counts mislead in both directions. Turning on credentialed scanning or onboarding assets increases the number while reducing risk; a falling count can simply mean a scanner broke or a credential expired. Neither tells leadership whether the exploitable, reachable things are getting fixed.

For the board, one line: “X internet-facing exploitable findings, Y remediated within SLA, Z open exceptions with named owners and expiry dates,” with quarterly movement. Keep the technical backlog underneath; the executive view is about exposure over time and whether exceptions are being managed or accumulating.