Read a scan report without drowning

Everyone's first big scan report is overwhelming. The trick is to stop trying to fix everything and start applying a simple triage flow. Aim to have every finding reach a decision (fix, accept, defer, duplicate) within one week of appearing.

The five-lens triage

1. Severity: highest first. Criticals jump the queue regardless of asset.
2. Exposure: externally reachable before internal-only.
3. Exploitability: is there a public exploit? CISA KEV? CVSS is a starting point, not the answer.
4. Business impact: what breaks if this is exploited? Don't rely on the scanner — only you know which app holds customer PII.
5. Effort: can we ship a fix today, or does it need a quarter of planning? Quick wins go first.

Accepted risk is a real choice

Some findings are genuinely acceptable: the asset is deprecated, the exploit requires impossible preconditions, or the fix cost outweighs the risk. Mark them “risk accepted” with a reason and an expiry — not “closed.” An auditor seeing a clean scan with no accepted-risk entries will ask “what did you suppress?”