Vulnerability triage in AppSec teams: how to structure the process
By Kike Gandia · Co-Founder & CEO, OSCP
AppSec teams are the most common bottleneck in vulnerability management. They receive reports from multiple sources — automated scanners, pentesters, bug bounty, external researchers, SAST/DAST — and have to decide what to patch first with limited resources. A well-designed triage process turns that chaos into a predictable workflow.
Why triage is AppSec's most critical process
Without triage, the backlog grows faster than the team can remediate. The four main sources of noise are: false positives from SAST/DAST scanners, duplicates from multiple tools, reports lacking exploitability context, and vulnerabilities in dependencies that don't affect your configuration. Teams with structured triage cut MTTR by 40-60% — not because they patch faster, but because the development team works on well-contextualized vulnerabilities.
The five phases of the AppSec triage process
A mature triage process has five phases:
1. Intake and deduplication: centralized receipt from all sources, deduplication and assignment of a unique identifier.
2. Technical validation: reproduction in a controlled environment, confirming the finding is real.
3. Severity and context assessment: CVSS 4.0 adjusted to your actual exposure + EPSS.
4. Prioritization and assignment: SLAs by severity, remediation tickets with full context.
5. Follow-up and closure: patch verification, documentation and communication back to the reporter.
Tools for automating AppSec triage
Tools like Defect Dojo, Nucleus Security, PlexTrac or Vulcan Cyber centralize findings from multiple sources and automate deduplication. Integration with Jira, GitHub Issues or Azure DevOps ensures vulnerability tickets follow the same workflow as the rest of development. No tool replaces human technical judgment, but they do automate the mechanical parts.
When to outsource triage
Outsourced triage makes sense if: your AppSec team has fewer than 3 people, you're handling more than 50 new vulnerabilities a month, MTTR exceeds 60 days for high-severity vulnerabilities, or the false-positive ratio exceeds 30% of the reports reaching your development team.
FAQ
How much time should an AppSec team spend on triage each week?
It depends on report volume. As a benchmark, a team of 3 people handling 100 reports a month should spend 20-30% of its time on triage if the process is efficient. Without a structured process, that percentage can climb to 50-60%, leaving little time for proactive security work.
Do SAST and DAST replace manual triage?
No. SAST and DAST are detection tools, not triage tools. They generate lists of possible vulnerabilities (with plenty of false positives) but can't assess business context, real exploitability in your specific configuration, or relative priority between findings. Manual triage is needed to turn scanner output into prioritized actions.
How do we measure whether our AppSec triage process is efficient?
Key metrics: false-positive ratio reaching the development team (target <10%), time from detection to ticket assignment (target <48h for criticals), MTTR by severity, and percentage of vulnerabilities within SLA. If you're not measuring these metrics, you can't improve the process.
Related service
Related content
Sources
- OWASP Top 10 — the most critical risks in web applications
- OWASP Web Security Testing Guide (WSTG) — the official reference methodology
We audit and optimize your team's vulnerability triage process