Two Collection Paths, Two Truths: Reconciling Agent and Scanner Findings
A vulnerability management team runs a single platform with two collection methods. About 4,200 of 12,000 assets carry an agent; the remaining 7,800 are scanned nightly from three scanner appliances. The quarterly report shows 61,300 findings from scans and 18,900 from agents, and 2,300 assets appear twice - once keyed by IP address and once by hostname - because a DHCP range rotates addresses weekly. The CISO wants one defensible count of critical vulnerabilities before a board meeting next week. Separately, a vendor risk report flags 340 findings rated CVSS 9.8 that carry a VPR of 4.1 or lower, and 96 findings rated CVSS 7.5 that carry a VPR above 9.0. The security team has no change control over the DHCP range and no budget to re-IP the estate this year.
1. The CISO asks for a single number of critical vulnerabilities. What do you deliver, and what do you explicitly decline to promise?
Read the worked answer
Do not hand over a raw sum. The 80,200 figure is an artefact of collection method, not risk.
Reasoning order:
- Fix identity before counting. Deduplicate on a stable identifier - agent UUID where present, otherwise authenticated host ID, then DNS name plus MAC. IP is unusable here: 2,300 duplicates on a weekly DHCP rotation implies roughly 9,700 distinct assets, not 12,000.
- Define the counting unit explicitly. A finding is a unique (asset, plugin, port, protocol) tuple. Overlap between scans and agents produces different plugin IDs for what an analyst reads as one problem; state the normalisation rule in the footnote so the number is reproducible next quarter.
- Separate coverage from findings. Agents reach local checks (installed patch level, registry, file permissions) that a network scan cannot see; scanners reach network devices and appliances that cannot host an agent. Report findings by collection path and state the credential success rate.
- Publish a number with a confidence statement - for example 'X critical findings across N deduplicated assets, covering 97% of the estate by either method'.
What to decline: any claim of completeness. Hosts with a dead agent, failed credentials, or no scan in the window are blind spots, not clean hosts. Say so in the same slide.
A defensible number with a stated blind spot survives audit scrutiny; a precise number without one does not.
2. A business owner challenges deprioritising the 340 CVSS 9.8 findings with low VPR. How do you justify the ranking, and what evidence would change your mind?
Read the worked answer
Justify on decision quality, not on which score is 'right'.
CVSS base score describes the severity of a flaw in the abstract: it is stable across your estate and says nothing about whether anyone is exploiting it. VPR folds in threat signals - exploit availability, recency of exploitation activity, and whether the vulnerability appears on watchlists. A 9.8 with a low VPR usually means a severe flaw with no credible exploitation path today; a 7.5 with a high VPR usually means someone is actively using it.
Evidence to lay out for the business owner:
- Exposure: is the asset internet-facing, in a regulated segment, or reachable from a lower-trust zone?
- Asset criticality and blast radius from the asset inventory, not from the finding list.
- Exploit maturity: is there public exploit code, a weaponised module, or observed campaign use?
- Compensating controls actually verified, not assumed.
What would change the ranking: evidence of exploitation in the wild, the asset becoming internet-facing, a compensating control being removed or found ineffective, or regulatory scope expanding to include the host. Any of those promotes the finding regardless of VPR.
Frame the output as a prioritised remediation queue with the ranking rationale attached, so a challenge becomes a data conversation rather than a scoring-argument.