Quick snapshot of your vulnerability posture

• Quick snapshot: how many open scanner findings exist across your estate right now? Options: Under 1,000, 1,000–5,000, 5,001–20,000, 20,001–50,000, 50,001+
• Tell me which vulnerability scanners and source systems you routinely run or export reports from Options: Network scanner exports, Agent-based scanner exports, Cloud provider vulnerability reports, Container/image scanner, Web application scanner, Endpoint detection outputs, Other
• How often do you produce a full-estate scan that you would use for prioritization? Options: Weekly, Monthly, Quarterly, Ad hoc, We do not run a full-estate scan
• Describe the three most critical asset groups your leadership insists are prioritized during an audit
• If you had to pick one metric that would convince your board that a new prioritization approach works, which metric would make you sign off? Options: Reduction in remediation-worthy findings, Time to remediate critical exposures, Percentage of internet-facing critical assets without high risk, Suppression rate of non-exploitable findings, Clear routing into existing ticketing

Where the current process fails

• Why do thousands of medium-severity findings still consume your team's time while high-priority exposures remain unpatched?
• List the top three recurring reasons remediation tickets miss their target windows Options: No agreed maintenance window, Prioritization disputes between security and ops, Ticketing routing or mapping errors, App owner approval delays, Resource shortages, Other
• When the remediation queue grows, which downstream teams feel the impact first and how does that show up in their metrics or SLAs?
• Pinpoint a recent example where a vulnerability caused a near-miss, audit finding, or external scrutiny; what happened and how long until resolution?
• What single failure in your current process would make you cancel a planned pilot with a vendor immediately?

How you decide what gets patched

• Who currently makes the final call on remediation priority, your security team or IT operations, and how often do they disagree? Options: Security decides, IT operations decides, Shared committee, Depends on asset
• Share your current prioritization rule set — is it primarily CVSS, exposure, exploit availability, business criticality, or a combination? Options: Primarily CVSS, Exposure and internet-facing status, Exploit availability / threat intelligence, Business criticality from CMDB, Custom weightings and exceptions, Combination
• How many remediation tickets does your vulnerability program open per month on average? Options: Under 50, 50–200, 201–1,000, 1,001–5,000, Over 5,000
• Describe how remediation assignments flow into your ticketing system, including any automated mappings and where manual triage occurs
• If a tool could reduce your remediation-worthy queue by 70% during a two-week proof that requires read-only data access, what would stop you from approving that proof?
• Which ticketing systems must integrate for this to be viable for you? Options: Primary ITSM platform, Secondary ITSM, Custom in-house ticketing, Email-based assignments, No integration required for pilot, Other

Who needs to be convinced

• Imagine you present a new prioritization approach to leadership, which stakeholders will insist on proof and what specific evidence will they request?
• Name the person who can greenlight a pilot and the person who approves production rollouts
• In what way does IT operations measure workload and how would they judge a new remediation plan as reducing burden rather than adding it?
• Confirm whether security, IT operations, risk/compliance, and procurement each hold budget or timeline vetoes for this project Options: Security, IT operations, Risk/compliance, Procurement, No single veto
• Should the pilot demonstrate the expected suppression and routing accuracy, who can sign the purchase order and how quickly could they commit?

Readiness and practical constraints

• Which required integrations or data feeds are not available today and would block a 30-day deployment? Options: No scanner export access, Ticketing API unavailable, No asset inventory mapping, Threat intelligence feeds unavailable, Legal or data sharing block, None of the above
• Identify the primary owner for each required data source and whether they can provide access without a legal review Options: Security team, IT operations, Cloud platform owner, Application owner, Procurement, Unsure
• Estimate the headcount and skill set your team can dedicate to a two-week proof and a 60-day rollout Options: No dedicated headcount, 1–2 engineers/analysts, 3–5 engineers/analysts, Dedicated project team >5
• Name the regulatory, legal, or procurement approval that would stop an engagement immediately if not granted Options: Regulatory approval, Legal data sharing sign-off, Procurement process clearance, Security architecture review, None blocking
• Do your scanner exports include normalized asset identifiers that map to your CMDB or cloud inventory? Options: Yes, full mapping, Partial mapping, No mapping available, We do not have a CMDB
• List any firewall, segmentation, or access constraints the team will need to work around during data ingestion

The other options you are weighing

• What alternatives are you actively evaluating today, including the incumbent and any internal build plans? Options: Current scanner vendor's prioritization, Internal scripts and spreadsheets, Another risk-based platform, SIEM vendor add-on, Do nothing / status quo, Other
• For each alternative listed, what would have to be true about it for you to keep your current approach instead of switching?
• Has anyone internally proposed solving this without a vendor, and if yes, who would lead that effort and what is the estimated timeline? Options: Yes, internal team with <3 months, Yes, internal team with 3–6 months, Yes, but >6 months, No internal plan
• Assuming an internal project matched suppression and routing accuracy, what single factor would still make you prefer an external partner?
• Rank the importance of these vendor attributes for your decision: speed of onboarding, visibility for leadership, ticketing fidelity, accuracy of exposure modeling Options: Speed of onboarding, Board-ready visibility, Ticketing fidelity, Accurate exposure and topology modeling

Gates, metrics, and the moment we know it worked

• Define the success metrics and thresholds you will use to judge the pilot within two weeks Options: Suppression rate target, Reduction in remediation-worthy findings, Routing accuracy to ticketing, Time-to-first-verified-remediation, Board-ready summary
• Give a concrete example from the last quarter where a prioritized remediation would have changed the outcome for a critical asset
• Estimate the minimum suppression rate and ticket routing fidelity you would accept to move to a full rollout Options: Suppression 40% / routing 70%, Suppression 60% / routing 80%, Suppression 70% / routing 90%, Other
• Assuming the pilot proves the stated numbers, what is the shortest approval path to a signed contract and who must approve it?
• Specify the reporting cadence and format your leadership expects for the pilot, and who needs access to those reports Options: Daily dashboard, Weekly written summary, Board-ready executive slide, API feed into internal portal, Ad hoc on request

Next steps and potential showstoppers

• Identify the single scheduling or resource constraint that would stop this project from starting in the next 30 days
• Confirm a realistic pilot start date range that works for your team Options: Within 2 weeks, 2–4 weeks, 1–2 months, Unsure
• Should the pilot deliver the expected reduction in remediation-worthy findings, what internal obstacles could still prevent conversion to a paid engagement?
• Provide the stakeholders you would like to include in a kickoff call to enable fast decisions Options: Security director, IT operations lead, Application owners, Risk/compliance, Procurement, Other
• Do you have any non-negotiable legal, security, or policy requirements we must meet before a proof begins? Options: Yes, No, Unsure

• desired_state
• success_criteria
• stakeholders
• gaps
• current_state
• decision_readiness
• desired_state
• decision_readiness
• success_criteria
• stakeholders
• current_state
• gaps
• stakeholders
• current_state
• desired_state
• success_criteria
• gaps
• decision_readiness
• success_criteria
• gaps
• desired_state
• current_state
• decision_readiness
• decision_readiness
• decision_readiness
• decision_readiness

• Ingest and Normalize Scanner Output
• Enrich Assets with Network Topology and Exposure
• Apply Threat and Exploit Intelligence Feeds
• Detect and Suppress Non‑Exploitable Findings
• Generate Risk‑Ranked Remediation Queue
• Configure Asset Criticality Scoring
• Integrate Remediation Tickets to ITSM
• Configure Ticket Routing and Assignment Rules
• Deploy CISO Risk and Board Dashboard
• Map Internet‑Facing Attack Surface
• Enable Continuous Scan Synchronization
• Export Evidence Package for Regulatory Audit
• Deliver Remediation Playbook Templates and Handover

Ingest and Normalize Scanner Output

• Provide the file path or upload link to your last quarterly vulnerability scan export (CSV, XML, or JSON) used for the two-week proof of value.
• Upload a sample scan export or indicate the typical export format your scanner produces. Options: CSV, XML, JSON, NDJSON, Other
• Attach or describe the field mapping in your scan export for asset identifiers (IP, hostname, MAC, asset tag) and provide the expected record count for the sample.
• List the scanner product family or export type and the versions you run across your estate (format: product-family/version or 'unknown'). Options: Known product family, Custom scanner export, Cloud provider scan, Unknown
• Specify the maximum acceptable time window between the scan timestamp in your export and platform ingestion for the PoV (for example, within 7 days). Options: Within 24 hours, Within 7 days, Within 30 days, Custom
• Identify who in your team will supply credentials or SFTP/API access for automated scan retrieval and provide their contact role/title.

Enrich Assets with Network Topology and Exposure

• Name the canonical asset inventory source you will provide (CMDB export, asset inventory CSV, IPAM export) and include the exported fields you can supply (at minimum: IP, hostname, owner).
• Indicate whether you can provide a network single-line diagram (SLD) or an export of routing/topology that maps VLANs and public subnets for your environment. Options: Yes — SLD available, Yes — topology export (CSV/JSON), No
• How do you currently label internet exposure for assets in your inventory (for example: public IP flag, DMZ tag, firewall rule reference)? Options: Public IP flag, DMZ tag, Firewall rule reference, No exposure label, Other
• Which environment boundaries in your estate should be modeled for criticality (production, pre-production, cloud, OT/ICS)? Select all that apply. Options: Production, Pre-production, Cloud, OT/ICS, Other
• Who within your organization is the owner responsible for asset context disputes during the pilot and what is their role/title?
• When do you refresh your asset inventory exports today (daily, weekly, monthly)? Options: Daily, Weekly, Monthly, Quarterly, Ad hoc

Apply Threat and Exploit Intelligence Feeds

• Where are your threat feed endpoints or sample feed files located (STIX/TAXII endpoint, file share) and can you provide a read-only access path for testing?
• Do you require the platform to subscribe to your internal threat feeds (STIX/TAXII) during the PoV, or should the platform consume public/external feeds only? Options: Subscribe to internal feeds, Use public feeds only, Both, Not applicable
• Are there specific exploit maturity indicators you want prioritized from feeds (proof-of-concept exploit, observed exploitation in the wild, exploit kit availability)? Options: Proof-of-concept exploit, Observed exploitation in the wild, Exploit kit availability, All of the above, Other
• Will you allow the platform to query external reputation and exploit databases for your internet-facing assets during the pilot? Options: Yes, No, Yes — with a data processing agreement
• Confirm any legal or regulatory constraints on ingesting threat intelligence (for example, export controls or handling of overseas feeds) that would affect feed selection. Options: No constraints, Constraints — provide details
• Estimate the targeted reduction in specific findings you require from threat and exploit enrichment during the PoV (for example, 80% reduction). Options: >90%, 80-90%, 50-79%, Custom

Detect and Suppress Non‑Exploitable Findings

• Select the suppression rule categories you want applied automatically in the pilot (for example: protocol not reachable, missing service, non-runnable binary). Options: Protocol not reachable, Service not present, Non-runnable binary, Environmental configuration, Other
• Choose whether suppression in your workflow should be suggested for reviewer approval, auto-applied, or flagged for your IT remediation review. Options: Suggested — reviewer approves, Auto-apply suppression, Flag for IT review
• For suppressed findings, what metadata from your scans should be retained for audit (for example: original CVE, scan timestamp, suppression rationale, suppression owner)? Options: Original CVE, Scan timestamp, Suppression rationale, Suppression owner, All of the above
• Describe your current false-positive or non-exploitable classification process and list any existing suppression lists we must import (include file format and approximate size).
• Outline the expected SLA for responding to a suppression dispute raised by your remediation team during the pilot (for example, 3 business days). Options: 24 hours, 3 business days, 7 business days, Custom
• State who in your organization will be authorized to approve automatic suppression rules and provide their role/title.

Generate Risk‑Ranked Remediation Queue

• Supply the list of remediation ticket fields your ITSM requires to create a remediation ticket from a prioritized finding (for example: summary, CVE, affected IP, justification). Provide the exact field names.
• Share your team's current criteria for ranking urgency among the top 20 assets (for example: business impact metrics, regulatory exposure, internet exposure) and any weighting rules in use. Options: Business impact only, Exposure plus impact, Custom weighting, No formal criteria
• Enter the acceptable threshold for elevating a finding to immediate remediation during the PoV (for example: internet-facing and exploit available). Options: Immediate if internet-facing and exploit available, Immediate if critical asset, Other
• Give an example of three findings from your last quarterly scan that you consider highest priority and explain why (include asset identifier, CVE, and business impact).
• Clarify the measurable acceptance criteria for the pilot's risk-ranked remediation queue (example metrics: top-20 asset alignment within 80% of your SME list, suppression >= specific percentage, and correct ticket routing for 95% of generated tickets). Options: Use suggested metrics, Provide custom thresholds
• Explain how you want exceptions handled in the remediation queue (temporary defer, mitigation note, reassign to change management) and specify the exception tags to apply. Options: Temporary defer, Mitigation note, Reassign to change management, Other

Configure Asset Criticality Scoring

• Detail the asset criticality attributes you want included in the scoring model (for example: business owner, data classification, regulatory scope, uptime SLA) and indicate which attribute is primary.
• Report the maximum number of criticality tiers you want the model to use (for example: 3 or 5) and provide label examples for each tier. Options: 3 tiers, 5 tiers, Custom
• Set the weighting you want applied between internet exposure and business impact for criticality scoring during the pilot (provide percentage split). Options: 50/50, 70/30, 30/70, Custom
• Define the canonical source for owner and business-unit fields (CMDB field name or asset inventory column) that we should map into the scoring model.
• Mention any regulatory controls that should influence criticality (for example: PCI, HIPAA, SOC2) and list the specific control identifiers to be considered. Options: PCI, HIPAA, ISO 27001, SOC2, Other
• Include whether service topology (for example: load balancer or cluster membership) should elevate criticality for grouped assets in your environment. Options: Yes, No, Only for public-facing clusters

Integrate Remediation Tickets to ITSM

• Map the ITSM integration method you prefer for ticket creation (API push, inbound email, middleware) and indicate the integration endpoint type your ITSM supports. Options: API push, Inbound email, Middleware connector, Other
• Align on the ITSM queue or service desk project names where remediation tickets should be created and provide the exact queue/project identifiers.
• Provide the API authentication method your ITSM requires (API token, OAuth2 client credential, basic auth) and confirm whether a dedicated integration account can be provisioned. Options: API token, OAuth2 client credentials, Basic auth, Other
• Upload a sample ticket creation payload or schema from your ITSM (for example JSON example or exported schema) to assist mapping analysis.
• Attach any existing business rules in your ITSM that affect ticket assignment or auto-closure (for example: SLA triggers, automation names).
• List the configuration item (CI) fields and custom fields that must be populated on remediation tickets for downstream change management.

Configure Ticket Routing and Assignment Rules

• Specify the default ticket priority mapping from our severity bands to your ITSM priority field (for example: high->P1, medium->P2). Options: Map now, Request mapping workshop, Use standard mapping
• Identify the resolver groups or teams and provide exact team identifiers or email aliases for assignment routing during the pilot.
• Name the escalation path you want used (first resolver, escalation owner, SOC manager) and indicate the SLA windows for each step. Options: 24 hours/48 hours, 4 hours/24 hours, Custom
• Indicate whether automated reassignment rules should consider your maintenance windows or business hours and provide your maintenance window schedule if applicable. Options: Consider maintenance windows, Ignore maintenance windows
• How should duplicate findings related to the same CI be handled in your ticketing workflow (merge into existing ticket, append to ticket, create new ticket)? Options: Merge into existing, Append to existing, Create new ticket
• Which ticket fields should carry our remediation rationale and suppression status for audit traceability in your ITSM? Options: Description field, Custom field, Attachments only, All of the above

Deploy CISO Risk and Board Dashboard

• When do you need the initial executive dashboard delivered during the PoV (for example: end of week 1 or end of week 2)? Options: End of week 1, End of week 2, Custom
• Where will executive dashboards be displayed or embedded for your leadership (SaaS console, embedded in internal portal) and do you require single sign-on integration? Options: SaaS console, Embedded in portal, Both
• Do you have mandated KPIs for board reporting that must appear on the CISO dashboard (for example: time-to-remediate, reduction in specific findings, exposure reduction)? Select all required KPIs. Options: Time-to-remediate, Reduction in specific findings, Exposure reduction, Custom KPI
• Are there specific visualizations your board expects (for example: trend lines for exposure over time, heat maps of internet-exposed assets)? If yes, provide examples or mock-ups.
• Will the dashboard require role-based visibility for different viewers (for example: CISO view vs remediation manager view)? List the roles needing unique views. Options: Yes — multiple views, No — single view
• Confirm the acceptance criteria for the CISO dashboard for pilot sign-off (which KPI thresholds and dashboard widgets must be validated by your security leadership). Options: Use suggested KPI thresholds, Provide custom acceptance thresholds

Map Internet‑Facing Attack Surface

• Estimate the number of public IP ranges and internet-facing services you expect to include in the pilot (approximate count). Options: Less than 100, 100-1,000, 1,000+
• Select the sources you want used to map exposure (for example: edge firewall rules, cloud security group exports, external port scan). Options: Edge firewall rules, Cloud security group exports, External port scan, Other
• Choose whether live external scanning by the platform against your public IP space is permitted during the pilot, and if so when. Options: Permitted, Not permitted, Permitted during maintenance window only
• For internet-facing assets, what proof of exposure do you accept as valid evidence (for example: open TCP port confirmation, banner grab, passive scan evidence)? Options: Open TCP port confirmation, Banner grab, Passive scan evidence, Other
• Describe how you currently track internet-facing asset ownership and who in your team is accountable for remediation.
• Outline any IPs or CIDR ranges that are out of scope for the pilot (for example: third-party hosted assets, vendor-managed services) and provide the CIDR lists if applicable.

• Order Form / Subscription Agreement
• Non-Disclosure Agreement (NDA)
• Data Processing Agreement (DPA)
• Data Access & Ingestion Authorization
• Security & Governance Addendum
• Acceptance Criteria & Success Metrics Statement
• Implementation Timeline & Milestone Schedule

• Go-live Health Check (weeks 1-4)
• First Measurement Review (weeks 4-10)
• Acceptance Gate Review (approximately day 90)
• Quarterly Success Review

• Publish the prioritized enhancement backlog with target delivery windows for the next quarter.
• Remap ticketing fields to ensure remediation ticket creation success and provide a test report.
• Restate acceptance criteria and numeric targets
• Formal, documented acceptance decision recorded with pass/fail for each criterion recorded in Solution Scope and a named signatory.
• Remediation items for any failed or conditional criteria with deadlines and owners documented.
• Incumbent prioritization process retired or formally retained read-only with data archived and fallback closure plan agreed.
• Publish the acceptance decision record including pass/fail status and the named signatory.
• Execute the incumbent wind-down plan or set the incumbent to read-only and archive prior data sets.
• Track remediation items to closure and publish a timeline for verification steps.
• Rolling KPI and trend review
• Confirm whether key KPIs are at or moving toward the targets recorded in Solution Scope and surface any regressions.
• Ensure persistent blockers have owners and firm resolution dates to prevent backsliding.
• Agree the prioritized enhancement items for the next quarter and the expected delivery window.
• Update remediation playbooks for top critical assets and circulate the revised playbook.
• Schedule integration mapping updates and deliver a post-change test report.
• Re-confirm success criteria and owners
• Deployment components validated as complete or assigned specific remediation tasks with dates.
• Named owners confirmed for each success criterion recorded in Solution Scope.
• Immediate blockers documented with remediation plan and target resolution dates.
• Resolve connector errors and document root cause and remediation steps.
• Enable ticketing mappings for the pilot asset group and confirm test ticket creation.
• Deliver the first post-go-live dataset to the platform for the scheduled measurement.
• Present first measurement data
• Determine whether percent reduction in specific findings and suppression rate of non-exploitable findings are trending toward the targets recorded in Solution Scope.
• Agree a short list of corrective actions with dates and verification steps to close gaps before the acceptance gate.
• Confirm readiness criteria and data schedule for the acceptance gate meeting around day 90.
• Adjust asset-criticality mappings for internet-facing asset groups and document the changes.
• Tune suppression rules for non-exploitable findings and deliver before the next data refresh.
• Persistent adoption blockers and incident review
• Present outcome data against each criterion
• Deployment validation
• Top 20 critical assets sanity check
• User onboarding and access
• Enhancement request backlog and prioritization
• Root-cause diagnosis for gaps
• Document pass/fail per criterion and signatory decision
• Corrective actions and timeline to acceptance gate
• Early operational signals
• Agree remediation items and resolution timeline
• Integration and ticketing health check
• Incumbent wind-down checkpoint
• Blockers and immediate remediation plan
• Agree next checkpoint and data refresh cadence