Skip to content
Handbook · 53 pages · free with a work email

A new CVE lands. Here is how to decide what to do.

Ask your AI agent about a new vulnerability with sources attached: Lattice. See Lattice

The method we use to check, analyse and triage a vulnerability, written down so that someone who is not a full-time analyst can repeat it and defend the result. Real CVEs from one week, read from the CVE records and the CISA catalogue, and scripts that were run on live data.

Read the outline first: How we check, analyse and triage a CVE.

Cover of The CVE Triage Handbook: how to check, analyse and triage a vulnerability, and prove you closed it.

What is in it

  1. CheckPart II

    Which source answers which question, a field-by-field reading of a real record, and how to notice a change.

  2. AnalysePart III

    Preconditions, version spans, and whether the vulnerable code is reachable on your systems.

  3. TriagePart IV

    Five questions and six outcomes, eight worked cases and the awkward ones.

  4. ActPart V

    The mitigation ladder, proving a fix, and looking back for damage.

  5. Run itPart VI

    A thirty-minute daily routine, the records and numbers worth keeping, and how to tell people.

A change in a signal, such as a new exploitation notice or a revised record, sends you back to Triage.
FoundationsPart I

The vocabulary, why the feeds disagree, and how to decode a CVSS 3.1 and 4.0 vector. Every step above stands on it.

AI agentsPart VII

What to hand an assistant, what to keep, and four questions that work on an assistant or an analyst.

AppendicesPart VIII

Five scripts, six templates, four checklists, a glossary and the sources.

What makes it different

Worked on real records

Fragnesia, the VMware logging flaw, Brotli, Adobe Commerce, jackson-databind, Kafka Connect, MLflow and more, each with the command and the output.

Says what it could not read

Where a source did not render or two sources disagreed, the handbook says so. Our judgements are marked as ours.
What it is not
Not a scanner and not a product. The scripts fetch public data and compare it; they do not find affected systems on your estate. The decision stays with the person who knows what the asset does.

Get the handbook

Register with a work email. We send one confirmation; when you press its button, the page you land on has the PDF, and the same link stays in the email. A person at NamiQ will also read your registration.

Optional. Only if you would rather we called.

Optional. Tells us your timezone and which rules apply.

Optional. Helps us tell you quickly whether we are a fit.

Backups nobody has tested, a server someone else built, access you cannot account for — whatever comes to mind first is usually the right answer.

We keep your name, work email, company and role. Nothing else. Privacy · Unsubscribe or delete