Who’s Vulnerability Is It Anyway? Harmonizing Stakeholder Roles in Vulnerability Management
summary
Panel argues that the bottleneck is inventory and remediation, not topic chatter: teams actually build an aggregation layer that dedupes multiple scanners, use Snyk’s rescore and EPSS to de-prioritize noise, and group fixes by package or image layer instead of CVE by CVE; operators validate scanner hits with quick screen‑shares and developers reduce toil by rebuilding images nightly and automating patch rollouts, proving that context beats raw counts.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:45Stakeholder roles in vulnerability management
- 5:59Key priorities per persona
- 12:21KPIs and measurement challenges
- 19:02False positives impact
- 27:10False negatives blind spots
- 33:14Scanner selection and results
- 38:06Remediation strategies
- 43:06Vulnerability disclosure ownership
- 45:14Risk assessment beyond counts
- 51:12Security tools love and hate
- 52:37One tip per stakeholder
- 55:24Empowering developers
- 58:15Q&A: Prioritization vs remediation
related talks
27mEffective Vulnerability Management for a DevSecOps Pipeline
11mVulnerability Supply Chains
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
33mFrom Chaos to Calm: Vulnerability Management for a Dynamic, Sprawling Technology Estate
33mVulnerability Management Lifecycle in DevSecOps
37mPrioritizing Vulnerability Response with a Stakeholder Specific Vulnerability Categorization- 43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
27mThe Vulnerability Ecosystem’s Vendor Bias — Exposed by Open Source