# Vulnerability Triage and Management

> Master risk-based vulnerability triage, contextual scoring, and exception management to prioritize remediation and eliminate alert fatigue.

Canonical: https://codelivly.com/rooms/vulnerability-triage-and-management
Last updated: 2026-10-29

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 5 |
| Estimated time | 30 min |
| XP | 100 |

This module transitions you from simply finding vulnerabilities to effectively managing them at scale. You will learn the principles of risk-based vulnerability triage, moving beyond raw CVSS scores to incorporate exploitability, environmental context, and business risk. We will cover the lifecycle of a vulnerability finding, including validating false positives, establishing Service Level Agreements (SLAs) for remediation, and managing formal risk exceptions. The module culminates in a hands-on guided lab where you will act as a Security Champion, triaging a massive backlog of mixed SAST, SCA, and infrastructure findings to create a prioritized, actionable remediation roadmap.

## Lessons

1. What Is Vulnerability Management in DevSecOps and Why Does It Matter (30 min)
2. False Positives, Risk Scoring and Prioritization (30 min)
3. Centralizing Findings with DefectDojo (30 min)
4. Defining Severity SLAs and Security Quality Gates (30 min)
5. Guided Lab: Building a Quality Gate That Fails the Build (30 min)

## Related

- [Learning path: Application Security Testing in Pipelines](https://codelivly.com/learning-paths/application-security-testing-in-pipelines)
- [All rooms](https://codelivly.com/rooms)