Know whether to patch, mitigate, monitor, escalate, or investigate.
First 10 Minutes
Start triage without turning noise into panic.
Use this short routine when a new CVE, advisory, KEV item, vendor note, or exploit rumor lands and you need a defensible first read before assigning work.
Leave with a clear next step, evidence gap, or handoff target.
Do not treat score, PoC, KEV, or scanner output as proof of exposure by itself.
New vulnerability pressure appears and the team needs a quick first pass.
Minute-by-minute
A calm triage sequence
The first pass should reduce uncertainty, not solve every detail. Stop when you have enough evidence to choose the next owner.
Name the signal
Capture the CVE, vendor advisory, product family, source, first-seen time, and whether the signal is score, exploit, patch, exposure, or news.
Separate proof from pressure
Ask what is confirmed: affected versions, fixed build, KEV, public PoC, exposure, authentication, reachable asset, vendor guidance, or only a scanner match.
Check exposure fit
Decide whether the product exists, whether affected versions are present, whether it is internet-facing or sensitive, and whether compensating controls already reduce reachability.
Choose the action lane
Pick patch when a fix and confirmed exposure exist, mitigate when risk needs reduction before patching, monitor when exposure is weak, escalate when ownership or approval blocks progress, and investigate when evidence is missing.
Write the next owner ask
Send a specific ask with evidence, owner, deadline, fallback, and what to return if blocked. If no owner is known, escalate ownership instead of letting the item drift.
Keep the follow-up visible
Save the record, add state and owner notes, and set a review date for monitoring, mitigation, no-patch, or exception decisions.
Fast patterns
Common first-pass outcomes
Patch now candidate
Known exploited or high-confidence exploit pressure, reachable affected asset, fixed version available, owner known, and rollback path understood.
Mitigate first candidate
No fixed build, unsafe patch, delayed window, or high exposure where access restriction, workaround, segmentation, or detection can reduce risk now.
Investigate candidate
Signal is plausible but affected versions, reachability, source confidence, or business ownership are not confirmed yet.
Escalate candidate
Business impact, unknown owner, downtime approval, vendor delay, customer impact, or incident-response threshold needs a higher decision.