Body of Knowledge · Techniques and Models
Risk-based triage
Prioritising security findings by exploitability (whether the vulnerable path is reachable) and exposure (what it gives an attacker, and to how many), and fixing the whole class where several findings share a cause.
Evidence grade: practice A widely adopted practitioner model with clear provenance.
Use it when
A scanner's four hundred findings; an audit's list; any count that has paralysed a team.
Where it stops working
Exploitability is a judgment about reachability, and it changes as the system changes. Any triage is a snapshot.
Where the standard uses it
- TJ-6Security, privacy, and compliance as engineering responsibilitiesOwned by engineering, not delegated to a function.
Used alongside it
- Compliance as a programme practice
- Privacy by design practice
- Security of AI-generated code research
- Threat modelling practice
Cite this model
Chicago, BibTeX and licence →Engineering Management Academy. (2026). Risk-based triage. In Engineering Management Academy Body of Knowledge (Version 3.1, TEC.risk-based-triage). https://www.engineeringmanagement.academy/body-of-knowledge/techniques/risk-based-triage