Use application security scans, infrastructure vulnerability reviews, and CVE tracking to prioritize security risk and bring the right people into remediation.
Review vulnerable application dependencies
For development and application security teams
Your team is preparing a release and needs to understand the known vulnerabilities in its dependencies.
Add the application and its package versions, using a supported dependency file or manual entry. Run a scan, review matching OSV advisories, and prioritize affected dependencies by severity and applicability.
Use the advisory context to decide what to upgrade or investigate. Update the recorded versions after the change and scan again.
Manage infrastructure vulnerabilities
For platform, operations, and infrastructure teams
Your applications depend on services and infrastructure products whose versions also need security review.
Add infrastructure products with the versions you run. Review potential NVD matches alongside application findings so infrastructure exposure is part of the same conversation.
Check vendor guidance and the advisory’s configurations before planning an upgrade. A version match needs investigation in the context of your environment.
Triage urgent critical findings
For security teams and the engineers responsible for fixes
A completed scan identifies a new critical finding affecting an asset in your inventory.
Review its severity, affected version, and advisory details. Check whether the finding applies to the service and how that service is exposed. Configure severity preferences to route relevant new findings to your connected channels.
Give the responsible team the finding and asset context needed to investigate urgently. Alerts depend on completed scans and configured delivery; scheduled monitoring is planned.
Coordinate fixes with alerts and tickets
For teams sharing remediation across engineering and security
A finding needs a clear handoff so the work can be assigned and followed through.
Connect Slack, Microsoft Teams, or a supported messaging or webhook integration for alerts. Configure Jira Cloud to create issues for selected events and severity levels.
Assign and track remediation in Jira. After applying a fix, update the inventory and run another scan to review what remains. Jira issue creation does not imply automatic ticket closure or two-way status synchronization.
