Vulnerability & Exposure Management Prioritization

Atlas Retail Group • 2,400 stores • $1.2B e-commerce • PCI + SOC 2

Risk-Adj. Open Exposure Days

11.2

↓ 2.1d vs. last month

Tier-1 Critical Backlog

↑ 8 KEV-listed: 12

SLA Attainment (All Tiers)

81%

↑ 3% Goal: 90%

Attack Surface +30d

+3.1%

↑ 1.4% New microservices

MTTR Critical (Days)

9.4

↓ 1.2d Target: 7d

Prioritized Remediation Queue — Top 25

Priority	CVE	Asset	Tier	BU	CVSS	EPSS	KEV	ROED	Owner	SLA
1	CVE-2023-46604	payment-gateway-03	1	Payment	9.8	94.2%	KEV	22d	Platform	Breach
2	CVE-2023-44487	api-gateway-prod-01	1	E-Commerce	7.5	89.1%	KEV	19d	Engineering	Breach
3	CVE-2023-42793	checkout-service-v2	1	E-Commerce	9.1	87.4%	KEV	18d	Engineering	Breach
4	CVE-2023-36884	payment-processor-02	1	Payment	8.3	82.6%	KEV	17d	Platform	Breach
5	CVE-2023-38831	store-pos-gateway	1	Store Systems	7.8	76.3%	KEV	16d	Retail IT	Breach
6	CVE-2023-4966	loadbalancer-prod-01	1	E-Commerce	9.4	71.8%	KEV	15d	Infrastructure	Due 2d
7	CVE-2023-28252	identity-service-prod	1	Corporate	7.9	68.5%	KEV	14d	Security	Due 3d
8	CVE-2023-3519	vpn-gateway-hq	1	Corporate	9.8	65.2%	KEV	13d	Infrastructure	Due 4d
9	CVE-2023-27997	marketplace-api-v3	1	E-Commerce	9.2	61.9%	Exploit	12d	Engineering	OK
10	CVE-2023-32315	inventory-sync-prod	1	Store Systems	8.1	58.7%	Exploit	11d	Retail IT	OK

Showing 10 of 25 • Priority = f(EPSS, KEV, Asset Tier, ROED, Compensating Controls)

ROED Burndown by Asset Tier (90d)

KEV-Matched CVE Trend (90d)

Remediation SLA Attainment by Owning Team

Team	Critical SLA %	High SLA %	Medium SLA %	Total Open	Breached	Avg ROED	Trend
Engineering	89%	84%	92%	142	16	9.1d	↑ 4%
Platform	67%	72%	88%	89	29	14.2d	↓ 2%
Infrastructure	78%	81%	90%	64	14	10.3d	↑ 1%
Retail IT	85%	87%	94%	112	17	8.7d	↑ 6%
Security	92%	94%	96%	31	2	6.4d	↑ 3%
Corporate IT	76%	79%	86%	48	12	11.8d	↓ 1%

Attack Surface Expansion (90d)

Marketplace microservices: +47 endpoints • Payment API v3: +22 endpoints

Scanner vs. Runtime Exposure Delta

Runtime-only detections: 34 • Scanner-only (not deployed): 89

Compensating Control Strength

WAF: 94% • Network Seg: 87% • EDR: 91%

Pen-Test Finding Closure

Critical 4/4

High 11/14

Medium 18/27

Last pen-test: Dec 2024 • Next: Mar 2025

BU Risk Ranking

Payment 847

E-Commerce 623

Store Systems 412

Corporate 289

Risk Score = ROED × Asset Count × Tier Weight

Largest Exposure Cluster — Payment Gateway Legacy Components

Apache ActiveMQ RCE (CVE-2023-46604)

Affects: payment-gateway-{01,02,03,04} • CVSS 9.8 • KEV Listed

Spring Framework RCE (CVE-2023-20863)

Affects: payment-processor-{01,02,03} • CVSS 8.1 • Exploit Available

Jetty HTTP/2 DoS (CVE-2023-44487)

Affects: All payment services • CVSS 7.5 • KEV Listed

Total cluster ROED: 312 days • Remediation plan: Q1 2025 migration to managed PaaS

Exception Queue

Lab Environment Exclusions

12 CVEs • Expires: Mar 15

Approved: Risk Committee

Air-Gapped OT Systems

8 CVEs • Permanent

Compensating: Physical Seg

Vendor Patching Lag

5 CVEs • Review: Jan 31

Mitigation: WAF Rules

Legacy POS Hardware

19 CVEs • Sunset: Jun 2025

Compensating: Network ACLs

Total exceptions: 44 • Re-assessment cycle: 90d

CISA KEV Feed: v2024.01.15 (Updated daily)

EPSS: v2024.01.14

Scan Coverage: 98.7%

Last Full Scan: 6h ago

Next Remediation Council: Jan 22, 2025