Ninety-one findings is not a security report

A client handed us the assessment their previous vendor had delivered. Ninety-one findings, sorted by CVSS score, each with a paragraph of generic remediation advice copied from the scanner's knowledge base. Twelve months old. Nothing had been fixed.

That is not a failure of diligence on the client's part. It is the predictable result of receiving an unrankable list. Faced with ninety-one items and no way to tell which four matter, the rational response is paralysis.

Why severity is not priority

CVSS scores a vulnerability in isolation. It is deliberately context-free, which makes it useful for describing a vulnerability and useless for prioritising your remediation.

A critical on an isolated internal host with no path to anything valuable matters less than a medium on the jump box that holds domain admin credentials. The scanner cannot make that distinction. It does not know your network, your data classification, or which system would end your week if it were compromised.

Severity describes the vulnerability. Risk describes what the vulnerability lets somebody do in your environment. Only the second one is actionable.

Work backwards from the target

Attack-path analysis inverts the process. Rather than enumerating weaknesses and sorting them, start from what an attacker would actually be after and map the routes that reach it.

1. 1Name the crown jewels concretely: the customer database, the payment path, the domain controller, the source repository.
2. 2Pick realistic starting positions — a phished user account, a compromised vendor login, an internet-facing service.
3. 3Map the routes between them. Every hop is a finding that matters, and a finding that shortens a route matters more than one that does not appear on any.
4. 4Rank by path length and impact. The finding that collapses a five-hop path to two is your first fix, whatever its score.

In the case above, this produced four findings on the critical path. The client's own team remediated all four in eleven days — work that had sat untouched for a year as part of a ninety-one item list. Nothing about their capacity changed. The list became rankable.

The rest of the findings still matter

To be clear: the other eighty-seven were not fictional. They were documented, with the reasoning for deprioritising each one written down, so the decision could be revisited when the network changed.

That last part matters more than it sounds. Deprioritised is not the same as dismissed. A finding that is unreachable today becomes reachable the moment somebody adds a firewall rule, and the record of why it was parked is what lets the next person re-evaluate it in seconds rather than reassessing from scratch.

A good report has fewer items in the main list and a longer appendix. If yours is the other way round, you have bought coverage rather than judgement.