May Office Hours: Introducing New Risk Based Prioritization

Risk-Based Prioritization in DefectDojo

DefectDojo CEO and creator Greg Anderson introduced a new risk-based prioritization feature available to all customers. It helps security teams sort through growing volumes of vulnerability findings by considering business context—not just the severity reported by a scanner.

Risk and priority

Risk is a contextual assessment of a finding’s potential impact on the business. Priority is a score for quickly comparing which issue to address first. Anderson said risk is more useful for senior decision-makers, while priority supports day-to-day triage.

How scoring works

The system starts with a finding’s base severity, then considers:

• Whether the finding is known to be exploited in the wild, using EPSS
• How many endpoints are affected and whether they are reachable
• Business context, such as criticality, user records, revenue, and applicable compliance fines

The feature is designed to work out of the box, even when an organization has little contextual metadata. Teams can also supply metadata and customize scoring ranges to reflect their priorities. In the presentation, automatically gathered data appeared in blue and optional supplied data in orange.

Risk classifications and product walkthrough

Risk classifications let teams organize findings by contextual risk rather than relying solely on scanner severity. Anderson described urgent findings as requiring immediate attention because of their high likelihood and significant potential impact. Medium- and low-risk findings can be addressed according to available capacity.

The demo showed risk and priority columns in the active-findings view, where users can sort and customize them. Anderson also previewed an insights dashboard planned for release the following Monday. It was expected to include breakdowns by product, component, SBOM, and host, as well as prioritized findings and the factors behind their scores.

Feedback and roadmap

Anderson said customers had requested more score customization and enrichment from additional data sources. DefectDojo was working on both areas.

Platform context

Anderson described DefectDojo as an open-source vulnerability-management and security-automation platform. It aggregates findings from security tools and automates tasks such as triage, deduplication, and enrichment. He said the platform had about 43 million downloads and was used by more than 10,000 organizations.

Presentation and demo: Greg Anderson delivered the feature overview and product walkthrough. Chris briefly participated in deciding to proceed with the demo.