Body of Knowledge · Glossary
Risk-based triage
Prioritising security findings by exploitability (whether the vulnerable path is reachable) and exposure (what it gives an attacker, and to how many), and fixing the whole class where several findings share a cause. It answers both failure modes, paralysis at the count and ignoring it.
Where the standard develops it
- TJ-6Security, privacy, and compliance as engineering responsibilitiesOwned by engineering, not delegated to a function.
Related terms
- Privacy by design
- Privacy as the default, built into ordinary engineering decisions (what is collected, where it is copied, who can read it, what is logged, how deletion works in practice) instead of bolted on afterwards.
- Threat modelling
- A design discipline built on four questions (what are we building, what can go wrong, what will we do about it, did we do a good job).
Cite this definition
Chicago, BibTeX and licence →Engineering Management Academy. (2026). Risk-based triage. In Engineering Management Academy Body of Knowledge (Version 3.1, GLO.risk-based-triage). https://www.engineeringmanagement.academy/body-of-knowledge/glossary/risk-based-triage