Vulnerability triage
Thousands of findings. Which ones matter?
Scanners report everything that could be a problem. Sentrasec checks each finding against your application and tells you which ones need action, with the evidence for every decision.
Severity is the scanner’s opinion
Point a few scanners at a mature codebase and you get thousands of findings, each with a severity the scanner assigned without knowing anything about your application. A critical in a test fixture and a critical behind a public endpoint look the same.
Someone then has to work out, finding by finding, which are real. That is where security teams lose their weeks, and where legacy applications collect backlogs nobody believes any more.
Triage is the step that turns a list into decisions. It should be done from evidence, and the evidence should be kept.
What triage checks
Every finding, whether Sentrasec raised it or your existing scanner did.
Is it reachable?
Whether the vulnerable code or endpoint can actually be reached in your application, rather than sitting in code nothing calls.
Does attacker input get there?
Whether input an attacker controls can flow to the vulnerable point, which is what turns a pattern match into an exploitable issue.
Does it ship?
Whether the code or package makes it into what runs in production, as opposed to tests, examples or build-time tooling.
Is it already mitigated?
Whether a compensating control is in place, so the risk is covered even if the code is unchanged.
How it works, step by step
01
Bring in findings
Run Sentrasec’s own scans, or import from Snyk, Semgrep, SonarQube, Checkmarx, Trivy and other scanners.
02
Deduplicate
Every result lands in one finding model on one severity scale, so the same issue is not counted three times.
03
Assess from evidence
Each finding is marked remediate or defer, and the evidence behind the decision is kept with it.
04
Review and act
A person accepts or rejects the assessment. Findings that need action get a remediation and test plan.
What it does not do
- Triage proposes; a person decides. An assessment waits for review before it changes a finding’s state.
- A deferred finding is not deleted. It stays on record with its evidence and can be reopened.
- Where the evidence is not there, the finding is not quietly dismissed: it stays open for a person to look at.
Questions
How is this different from sorting by CVSS?
CVSS describes a vulnerability in general. Triage asks whether it matters in your application: is it reachable, does attacker input get there, does the code ship, and is it already mitigated.
Does it work on legacy applications?
Yes. Legacy codebases are where the backlog is largest, and where separating real issues from noise saves the most time.
Can I keep my current scanners?
Yes. Findings imported from your existing scanners are triaged the same way as Sentrasec’s own.
See it on your own code
Bring a repository or a release you are about to ship. We will scan it, triage the findings and show you where it stands for security and compliance.
Native scanners →Continuous monitoring →For security teams →