Lab 06 — Vulnerability Data Analysis and Prioritization

Mission Information

Difficulty: Intermediate → Advanced
Estimated Time: 120–180 minutes
Primary Language: Python
Security Domain: Vulnerability Management / Security Operations / Risk Management
Environment: Local controlled lab
Automation Type: Defensive Vulnerability Analytics

Mission

Your task is to build a Python-based vulnerability analysis and prioritization pipeline.

You will start with:

RAW SCANNER EXPORT

containing:

ASSETS

VULNERABILITIES

SEVERITIES

CVSS SCORES

DUPLICATE FINDINGS

MISSING OWNERS

INTERNET EXPOSURE

REMEDIATION DATES

Then transform it into:

RAW FINDINGS
      ↓
VALIDATE
      ↓
NORMALIZE
      ↓
DEDUPLICATE
      ↓
ENRICH WITH ASSET CONTEXT
      ↓
CALCULATE PRIORITY
      ↓
MAP OWNER
      ↓
IDENTIFY OVERDUE ITEMS
      ↓
BUILD REMEDIATION QUEUE
      ↓
REPORT

Why This Lab Matters

A vulnerability scanner may produce:

10 FINDINGS

1,000 FINDINGS

100,000 FINDINGS

The security problem is rarely:

HOW MANY VULNERABILITIES EXIST?

The more important questions are:

WHICH FINDINGS MATTER MOST?

WHICH ASSETS ARE MOST IMPORTANT?

WHICH SYSTEMS ARE INTERNET EXPOSED?

WHICH FINDINGS ARE OVERDUE?

WHO OWNS THE AFFECTED SYSTEM?

WHICH ITEMS SHOULD BE FIXED FIRST?

That is the difference between:

VULNERABILITY SCANNING

and:

VULNERABILITY MANAGEMENT

Learning Objectives

By completing this lab, you should be able to:

READ VULNERABILITY CSV DATA

VALIDATE REQUIRED FIELDS

NORMALIZE SEVERITY VALUES

NORMALIZE ASSET NAMES

PARSE CVSS SCORES

REMOVE DUPLICATE FINDINGS

LOAD ASSET CONTEXT

MAP ASSET OWNERS

IDENTIFY INTERNET-EXPOSED SYSTEMS

IDENTIFY HIGH-CRITICALITY SYSTEMS

IDENTIFY OVERDUE REMEDIATION

BUILD A TRAINING RISK MODEL

GENERATE A REMEDIATION QUEUE

EXPORT CSV

EXPORT JSON

GENERATE MARKDOWN REPORTS

DOCUMENT ANALYSIS LIMITATIONS

Final Architecture

            SCANNER EXPORT
                  ↓
             CSV INGEST
                  ↓
              VALIDATE
                  ↓
              NORMALIZE
                  ↓
             DEDUPLICATE
                  ↓
          ASSET INVENTORY JOIN
                  ↓
        ┌─────────┼─────────┐
        ↓         ↓         ↓
     CVSS      CRITICALITY  EXPOSURE
        ↓         ↓         ↓
        └─────────┼─────────┘
                  ↓
             DUE DATE
                  ↓
          PRIORITY ENGINE
                  ↓
          OWNER MAPPING
                  ↓
        REMEDIATION QUEUE
          ┌───────┼───────┐
          ↓       ↓       ↓
         CSV     JSON     MD

Authorization and Safety

This lab uses:

SYNTHETIC VULNERABILITY DATA

Do not scan, assess, or prioritize systems outside your authorized environment.

The lab focuses on:

DATA ANALYSIS

RISK CONTEXT

REPORTING

REMEDIATION PLANNING

not exploitation.

01 — Create the Lab Workspace

Create:

vulnerability-prioritization/
|
+-- data/
|
+-- reports/
|
+-- src/
|
+-- tests/
|
+-- README.md

Linux/macOS:

mkdir -p vulnerability-prioritization/{data,reports,src,tests}
cd vulnerability-prioritization

PowerShell:

mkdir vulnerability-prioritization

cd vulnerability-prioritization

mkdir data
mkdir reports
mkdir src
mkdir tests

02 — Verify Python

Run:

python --version

or:

python3 --version

Recommended:

Python 3.10+

03 — Create the Asset Inventory

Create:

data/assets.csv

Add:

asset_id,hostname,environment,criticality,owner,internet_exposed
1,WEB01,Production,Critical,Web Team,true
2,DB01,Production,Critical,Database Team,false
3,APP01,Production,High,Application Team,false
4,DEV01,Development,Medium,Development Team,false
5,OLD01,Production,High,,false
6,VPN01,Production,Critical,Network Team,true
7,JUMP01,Production,Critical,Security Team,false

04 — Understand the Asset Context

Each asset includes:

HOSTNAME

ENVIRONMENT

CRITICALITY

OWNER

INTERNET EXPOSURE

These fields will influence remediation priority.

05 — Create the Vulnerability Export

Create:

data/vulnerabilities.csv

Add:

finding_id,hostname,vulnerability_name,severity,cvss,status,discovered_date,remediation_due_date
VULN-001,WEB01,Outdated Web Framework,Critical,9.8,Open,2026-08-01,2026-08-15
VULN-002,WEB01,Weak TLS Configuration,HIGH,8.1,Open,2026-08-02,2026-08-20
VULN-003,DB01,Missing Security Update,critical,9.5,Open,2026-08-03,2026-08-17
VULN-004,APP01,Outdated Application Library,High,7.8,Open,2026-08-05,2026-08-25
VULN-005,DEV01,Development Package Finding,Medium,5.0,Closed,2026-08-07,2026-09-07
VULN-006,OLD01,Legacy Service Exposure,Critical,9.0,Open,2026-07-15,2026-07-30
VULN-007,VPN01,Remote Access Security Update,Critical,9.1,Open,2026-08-10,2026-08-22
VULN-008,JUMP01,Administrative Tool Update,High,7.5,Open,2026-08-14,2026-09-05
VULN-009,WEB01,Outdated Web Framework,Critical,9.8,Open,2026-08-01,2026-08-15
VULN-010,APP01,Missing Application Header,medium,5.4,Open,2026-08-20,2026-09-20
VULN-011,UNKNOWN01,Unmapped Host Finding,High,8.0,Open,2026-08-21,2026-09-10
VULN-012,DB01,Invalid Score Example,High,not-a-score,Open,2026-08-22,2026-09-12

06 — Why This Dataset Is Useful

It includes:

DUPLICATE FINDING

INCONSISTENT SEVERITY CASE

OPEN AND CLOSED FINDINGS

CRITICAL ASSETS

INTERNET-EXPOSED ASSETS

MISSING OWNER

UNKNOWN ASSET

INVALID CVSS VALUE

OVERDUE REMEDIATION

07 — Create the Python Script

Create:

src/vulnerability_analyzer.py

Start with:

from pathlib import Path
from datetime import datetime, date
from collections import Counter, defaultdict
import csv
import json

08 — Define Project Paths

Add:

BASE_DIR = Path(__file__).resolve().parent.parent

ASSET_FILE = BASE_DIR / "data" / "assets.csv"

VULNERABILITY_FILE = (
    BASE_DIR /
    "data" /
    "vulnerabilities.csv"
)

REPORT_DIR = BASE_DIR / "reports"

REPORT_DIR.mkdir(
    parents=True,
    exist_ok=True
)

09 — Define the Lab Reference Date

For reproducible results, use:

REFERENCE_DATE = date(
    2026,
    8,
    29
)

Why Use a Fixed Date?

If you use:

date.today()

your results will change over time.

A fixed lab date provides:

REPRODUCIBLE OUTPUT

10 — Normalize Boolean Values

Create:

def parse_boolean(value):
    return (
        str(value)
        .strip()
        .lower()
        in {
            "true",
            "1",
            "yes"
        }
    )

11 — Normalize Severity

Create:

SEVERITIES = {
    "critical",
    "high",
    "medium",
    "low",
    "informational"
}

Then:

def normalize_severity(value):
    normalized = (
        str(value)
        .strip()
        .lower()
    )

    if normalized not in SEVERITIES:
        return "unknown"

    return normalized

12 — Why Normalize Severity?

Without normalization:

Critical

CRITICAL

critical

may behave like three different values.

After normalization:

critical

13 — Parse CVSS Safely

Create:

def parse_cvss(value):
    try:
        score = float(value)

        if 0.0 <= score <= 10.0:
            return score

    except (
        TypeError,
        ValueError
    ):
        pass

    return None

14 — Why Validate CVSS?

A scanner export might contain:

9.8

N/A

Unknown

not-a-score

Your script should not crash because one row contains bad data.

15 — Parse Dates

Create:

def parse_date(value):
    try:
        return datetime.strptime(
            value.strip(),
            "%Y-%m-%d"
        ).date()

    except (
        AttributeError,
        ValueError
    ):
        return None

16 — Normalize Hostnames

Create:

def normalize_hostname(value):
    return (
        str(value)
        .strip()
        .upper()
    )

Therefore:

web01

WEB01

Web01

become:

WEB01

17 — Load the Asset Inventory

Create:

def load_assets():
    assets = {}

    with ASSET_FILE.open(
        "r",
        encoding="utf-8",
        newline=""
    ) as file:

        reader = csv.DictReader(
            file
        )

        for row in reader:
            hostname = normalize_hostname(
                row["hostname"]
            )

            assets[hostname] = {
                "asset_id":
                    row["asset_id"],

                "hostname":
                    hostname,

                "environment":
                    row["environment"].strip(),

                "criticality":
                    row["criticality"]
                    .strip()
                    .lower(),

                "owner":
                    row["owner"].strip(),

                "internet_exposed":
                    parse_boolean(
                        row["internet_exposed"]
                    )
            }

    return assets

18 — Test Asset Loading

Temporarily:

assets = load_assets()

print(
    json.dumps(
        assets,
        indent=2
    )
)

Run:

python src/vulnerability_analyzer.py

19 — Required Vulnerability Fields

Create:

REQUIRED_FIELDS = {
    "finding_id",
    "hostname",
    "vulnerability_name",
    "severity",
    "cvss",
    "status",
    "discovered_date",
    "remediation_due_date"
}

20 — Validate CSV Schema

Create:

def validate_headers(fieldnames):
    if not fieldnames:
        return False

    return REQUIRED_FIELDS.issubset(
        set(fieldnames)
    )

21 — Load Vulnerability Data

Create:

def load_vulnerabilities():
    valid = []
    invalid = []

    with VULNERABILITY_FILE.open(
        "r",
        encoding="utf-8",
        newline=""
    ) as file:

        reader = csv.DictReader(
            file
        )

        if not validate_headers(
            reader.fieldnames
        ):
            raise ValueError(
                "Vulnerability CSV is missing required columns."
            )

        for line_number, row in enumerate(
            reader,
            start=2
        ):
            normalized = normalize_finding(
                row,
                line_number
            )

            if normalized["valid"]:
                valid.append(
                    normalized["record"]
                )
            else:
                invalid.append(
                    normalized["record"]
                )

    return valid, invalid

22 — Create the Finding Normalizer

Add:

def normalize_finding(
    row,
    line_number
):
    hostname = normalize_hostname(
        row.get(
            "hostname",
            ""
        )
    )

    vulnerability_name = (
        row.get(
            "vulnerability_name",
            ""
        )
        .strip()
    )

    severity = normalize_severity(
        row.get(
            "severity",
            ""
        )
    )

    cvss = parse_cvss(
        row.get(
            "cvss",
            ""
        )
    )

    discovered_date = parse_date(
        row.get(
            "discovered_date",
            ""
        )
    )

    due_date = parse_date(
        row.get(
            "remediation_due_date",
            ""
        )
    )

    record = {
        "line_number":
            line_number,

        "finding_id":
            row.get(
                "finding_id",
                ""
            ).strip(),

        "hostname":
            hostname,

        "vulnerability_name":
            vulnerability_name,

        "severity":
            severity,

        "cvss":
            cvss,

        "status":
            row.get(
                "status",
                ""
            ).strip().lower(),

        "discovered_date":
            discovered_date,

        "remediation_due_date":
            due_date
    }

    reasons = []

    if not hostname:
        reasons.append(
            "Missing hostname"
        )

    if not vulnerability_name:
        reasons.append(
            "Missing vulnerability name"
        )

    if severity == "unknown":
        reasons.append(
            "Unknown severity"
        )

    if cvss is None:
        reasons.append(
            "Invalid CVSS score"
        )

    if discovered_date is None:
        reasons.append(
            "Invalid discovered date"
        )

    if due_date is None:
        reasons.append(
            "Invalid remediation due date"
        )

    if reasons:
        record["reason"] = "; ".join(
            reasons
        )

        return {
            "valid": False,
            "record": record
        }

    return {
        "valid": True,
        "record": record
    }

23 — Test Vulnerability Loading

Temporarily:

valid, invalid = load_vulnerabilities()

print(
    f"Valid findings: {len(valid)}"
)

print(
    f"Invalid findings: {len(invalid)}"
)

Expected:

Valid findings: 11

Invalid findings: 1

because:

VULN-012

contains:

not-a-score

24 — Deduplication Strategy

Two findings can refer to the same underlying vulnerability.

For this lab, use:

HOSTNAME
+
VULNERABILITY NAME
+
STATUS

as a simple deduplication key.

25 — Build the Deduplication Key

Create:

def get_deduplication_key(
    record
):
    return (
        record["hostname"],
        record[
            "vulnerability_name"
        ].strip().lower(),
        record["status"]
    )

26 — Deduplicate Findings

Create:

def deduplicate_findings(
    records
):
    unique = []
    duplicates = []

    seen = set()

    for record in records:
        key = get_deduplication_key(
            record
        )

        if key in seen:
            duplicates.append(
                record
            )
            continue

        seen.add(key)

        unique.append(
            record
        )

    return unique, duplicates

27 — Why Deduplication Matters

Scanner pipelines may produce duplicates because of:

MULTIPLE SCAN JOBS

MULTIPLE SCANNERS

REPEATED IMPORTS

AGENT + NETWORK SCANS

DATA PIPELINE ISSUES

Without deduplication:

10 REAL FINDINGS

might appear as:

25 FINDINGS

28 — Deduplication Limitation

The simple key:

HOSTNAME + FINDING NAME + STATUS

is not universally reliable.

Production systems may need:

PLUGIN ID

CVE

PORT

PROTOCOL

SCANNER ID

ASSET ID

FIRST SEEN

FINGERPRINT

29 — Enrich Findings with Asset Data

Create:

def enrich_with_assets(
    findings,
    assets
):
    enriched = []

    for finding in findings:
        item = finding.copy()

        asset = assets.get(
            item["hostname"]
        )

        if asset:
            item[
                "asset_mapped"
            ] = True

            item.update({
                "environment":
                    asset[
                        "environment"
                    ],

                "criticality":
                    asset[
                        "criticality"
                    ],

                "owner":
                    asset[
                        "owner"
                    ],

                "internet_exposed":
                    asset[
                        "internet_exposed"
                    ]
            })

        else:
            item[
                "asset_mapped"
            ] = False

            item.update({
                "environment":
                    "unknown",

                "criticality":
                    "unknown",

                "owner":
                    "",

                "internet_exposed":
                    False
            })

        enriched.append(
            item
        )

    return enriched

30 — Why Asset Mapping Matters

Before enrichment:

Vulnerability:
Outdated Web Framework

CVSS:
9.8

After enrichment:

Vulnerability:
Outdated Web Framework

CVSS:
9.8

Asset:
WEB01

Environment:
Production

Criticality:
Critical

Internet Exposed:
Yes

Owner:
Web Team

That is much more actionable.

31 — Find Unmapped Assets

Create:

def get_unmapped_findings(
    findings
):
    return [
        item
        for item in findings
        if not item[
            "asset_mapped"
        ]
    ]

You should identify:

UNKNOWN01

32 — Why Unmapped Assets Matter

An unmapped vulnerability may mean:

ASSET INVENTORY GAP

HOSTNAME MISMATCH

STALE SCANNER RECORD

UNMANAGED ASSET

DECOMMISSIONING ISSUE

Do not silently ignore it.

33 — Determine Overdue Status

Create:

def is_overdue(
    finding,
    reference_date=REFERENCE_DATE
):
    if finding[
        "status"
    ] != "open":
        return False

    due_date = finding[
        "remediation_due_date"
    ]

    if due_date is None:
        return False

    return (
        due_date
        <
        reference_date
    )

34 — Add Days Overdue

Create:

def calculate_days_overdue(
    finding,
    reference_date=REFERENCE_DATE
):
    if not is_overdue(
        finding,
        reference_date
    ):
        return 0

    return (
        reference_date
        -
        finding[
            "remediation_due_date"
        ]
    ).days

35 — Add Finding Age

Create:

def calculate_finding_age(
    finding,
    reference_date=REFERENCE_DATE
):
    discovered = finding[
        "discovered_date"
    ]

    if discovered is None:
        return None

    return (
        reference_date
        -
        discovered
    ).days

36 — Why Age Matters

A critical vulnerability open for:

1 DAY

and a critical vulnerability open for:

120 DAYS

may require different management attention.

37 — Add Time Context

Create:

def add_time_context(
    findings
):
    results = []

    for finding in findings:
        item = finding.copy()

        item["overdue"] = (
            is_overdue(
                item
            )
        )

        item["days_overdue"] = (
            calculate_days_overdue(
                item
            )
        )

        item["finding_age_days"] = (
            calculate_finding_age(
                item
            )
        )

        results.append(
            item
        )

    return results

38 — Build the Risk Model

For training, create a score based on:

CVSS

ASSET CRITICALITY

INTERNET EXPOSURE

OVERDUE STATUS

MISSING OWNER

39 — Important Risk Warning

This scoring system is:

A TRAINING MODEL

It is not a universal enterprise risk formula.

Real prioritization may include:

KNOWN EXPLOITATION

EPSS

THREAT INTELLIGENCE

BUSINESS IMPACT

DATA CLASSIFICATION

EXPOSURE

COMPENSATING CONTROLS

ASSET FUNCTION

ATTACK PATH CONTEXT

40 — Criticality Weight

Create:

CRITICALITY_WEIGHT = {
    "critical": 30,
    "high": 20,
    "medium": 10,
    "low": 5,
    "unknown": 0
}

41 — Severity Weight

Create:

SEVERITY_WEIGHT = {
    "critical": 30,
    "high": 20,
    "medium": 10,
    "low": 5,
    "informational": 0,
    "unknown": 0
}

42 — Build Priority Score

Create:

def calculate_priority_score(
    finding
):
    if finding[
        "status"
    ] != "open":
        return 0

    score = 0

    score += SEVERITY_WEIGHT.get(
        finding["severity"],
        0
    )

    score += CRITICALITY_WEIGHT.get(
        finding["criticality"],
        0
    )

    if finding["cvss"] is not None:
        score += int(
            finding["cvss"] * 2
        )

    if finding[
        "internet_exposed"
    ]:
        score += 20

    if finding[
        "overdue"
    ]:
        score += 15

    if not finding[
        "owner"
    ]:
        score += 10

    return score

43 — Example Priority Calculation

Suppose:

Severity:
Critical
→ 30

Asset Criticality:
Critical
→ 30

CVSS:
9.8
→ 19

Internet Exposed:
Yes
→ 20

Overdue:
Yes
→ 15

Total:

This is:

A PRIORITIZATION SCORE

not a standardized risk value.

44 — Priority Categories

Create:

def determine_priority(
    score
):
    if score >= 100:
        return "P1"

    if score >= 75:
        return "P2"

    if score >= 50:
        return "P3"

    if score > 0:
        return "P4"

    return "Closed"

45 — Priority Meaning

For this lab:

P1
Immediate remediation review

P2
High-priority remediation

P3
Planned remediation

P4
Standard remediation

Closed
No active remediation queue

46 — Add Priority Context

Create:

def add_priority_context(
    findings
):
    results = []

    for finding in findings:
        item = finding.copy()

        score = (
            calculate_priority_score(
                item
            )
        )

        item[
            "priority_score"
        ] = score

        item[
            "priority"
        ] = determine_priority(
            score
        )

        results.append(
            item
        )

    return results

47 — Build the Complete Processing Pipeline

Create:

def process_findings():
    assets = load_assets()

    valid, invalid = (
        load_vulnerabilities()
    )

    unique, duplicates = (
        deduplicate_findings(
            valid
        )
    )

    enriched = (
        enrich_with_assets(
            unique,
            assets
        )
    )

    enriched = (
        add_time_context(
            enriched
        )
    )

    enriched = (
        add_priority_context(
            enriched
        )
    )

    return {
        "raw_valid_count":
            len(valid),

        "invalid_count":
            len(invalid),

        "unique_count":
            len(unique),

        "duplicate_count":
            len(duplicates),

        "findings":
            enriched,

        "invalid":
            invalid,

        "duplicates":
            duplicates
    }

48 — Test the Pipeline

Temporarily:

results = process_findings()

print(
    json.dumps(
        results,
        indent=2,
        default=str
    )
)

Run:

python src/vulnerability_analyzer.py

49 — Sort by Priority Score

Create:

def sort_findings(
    findings
):
    return sorted(
        findings,
        key=lambda item:
            item[
                "priority_score"
            ],
        reverse=True
    )

50 — Build the Remediation Queue

Create:

def build_remediation_queue(
    findings
):
    return [
        item
        for item in sort_findings(
            findings
        )
        if item[
            "status"
        ] == "open"
    ]

51 — Expected High-Priority Findings

Your highest-priority findings should likely include:

WEB01
Outdated Web Framework

VPN01
Remote Access Security Update

DB01
Missing Security Update

OLD01
Legacy Service Exposure

Exact ordering depends on your scoring logic.

52 — Why WEB01 Should Rank Highly

Context:

SEVERITY
Critical

CVSS
9.8

ASSET CRITICALITY
Critical

ENVIRONMENT
Production

INTERNET EXPOSED
Yes

OVERDUE
Yes

That combination creates stronger remediation urgency.

53 — Why OLD01 Deserves Attention

Context:

HIGH-CRITICALITY ASSET

CRITICAL VULNERABILITY

OVERDUE

NO OWNER

Even though it is not internet exposed, the ownership gap adds operational risk.

54 — Vulnerabilities Without Owners

Create:

def findings_without_owner(
    findings
):
    return [
        item
        for item in findings
        if (
            item[
                "status"
            ] == "open"
            and
            not item[
                "owner"
            ]
        )
    ]

55 — Internet-Exposed Findings

Create:

def internet_exposed_findings(
    findings
):
    return [
        item
        for item in findings
        if (
            item[
                "status"
            ] == "open"
            and
            item[
                "internet_exposed"
            ]
        )
    ]

56 — Overdue Findings

Create:

def overdue_findings(
    findings
):
    return [
        item
        for item in findings
        if item[
            "overdue"
        ]
    ]

57 — Critical Open Findings

Create:

def critical_open_findings(
    findings
):
    return [
        item
        for item in findings
        if (
            item[
                "status"
            ] == "open"
            and
            item[
                "severity"
            ] == "critical"
        )
    ]

58 — Count Findings by Severity

Create:

def count_by_severity(
    findings
):
    return Counter(
        item["severity"]
        for item in findings
        if item[
            "status"
        ] == "open"
    )

59 — Count Findings by Owner

Create:

def count_by_owner(
    findings
):
    counter = Counter()

    for item in findings:
        if item[
            "status"
        ] != "open":
            continue

        owner = (
            item["owner"]
            or "Unassigned"
        )

        counter[owner] += 1

    return counter

60 — Count Findings by Priority

Create:

def count_by_priority(
    findings
):
    return Counter(
        item["priority"]
        for item in findings
        if item[
            "status"
        ] == "open"
    )

61 — Build a Vulnerability Summary

Create:

def build_summary(
    results
):
    findings = results[
        "findings"
    ]

    open_findings = [
        item
        for item in findings
        if item[
            "status"
        ] == "open"
    ]

    return {
        "valid_raw_findings":
            results[
                "raw_valid_count"
            ],

        "unique_findings":
            results[
                "unique_count"
            ],

        "duplicates_removed":
            results[
                "duplicate_count"
            ],

        "invalid_findings":
            results[
                "invalid_count"
            ],

        "open_findings":
            len(
                open_findings
            ),

        "critical_open":
            len(
                critical_open_findings(
                    findings
                )
            ),

        "overdue":
            len(
                overdue_findings(
                    findings
                )
            ),

        "internet_exposed":
            len(
                internet_exposed_findings(
                    findings
                )
            ),

        "unowned_open":
            len(
                findings_without_owner(
                    findings
                )
            ),

        "severity_counts":
            dict(
                count_by_severity(
                    findings
                )
            ),

        "priority_counts":
            dict(
                count_by_priority(
                    findings
                )
            )
    }

62 — Export the Remediation Queue

Create:

def export_remediation_queue(
    findings
):
    output = (
        REPORT_DIR /
        "remediation-queue.csv"
    )

    fields = [
        "priority",
        "priority_score",
        "hostname",
        "environment",
        "criticality",
        "owner",
        "internet_exposed",
        "vulnerability_name",
        "severity",
        "cvss",
        "discovered_date",
        "remediation_due_date",
        "overdue",
        "days_overdue"
    ]

    with output.open(
        "w",
        encoding="utf-8",
        newline=""
    ) as file:

        writer = csv.DictWriter(
            file,
            fieldnames=fields,
            extrasaction="ignore"
        )

        writer.writeheader()

        for item in (
            build_remediation_queue(
                findings
            )
        ):
            writer.writerow(
                item
            )

63 — Export Invalid Findings

Create:

def export_invalid_findings(
    records
):
    output = (
        REPORT_DIR /
        "invalid-findings.csv"
    )

    fields = [
        "line_number",
        "finding_id",
        "hostname",
        "vulnerability_name",
        "severity",
        "cvss",
        "reason"
    ]

    with output.open(
        "w",
        encoding="utf-8",
        newline=""
    ) as file:

        writer = csv.DictWriter(
            file,
            fieldnames=fields,
            extrasaction="ignore"
        )

        writer.writeheader()

        writer.writerows(
            records
        )

64 — Export Duplicate Findings

Create:

def export_duplicates(
    records
):
    output = (
        REPORT_DIR /
        "duplicate-findings.csv"
    )

    fields = [
        "finding_id",
        "hostname",
        "vulnerability_name",
        "severity",
        "cvss",
        "status"
    ]

    with output.open(
        "w",
        encoding="utf-8",
        newline=""
    ) as file:

        writer = csv.DictWriter(
            file,
            fieldnames=fields,
            extrasaction="ignore"
        )

        writer.writeheader()

        writer.writerows(
            records
        )

65 — Export Unmapped Assets

Create:

def export_unmapped_findings(
    findings
):
    output = (
        REPORT_DIR /
        "unmapped-assets.csv"
    )

    records = get_unmapped_findings(
        findings
    )

    fields = [
        "finding_id",
        "hostname",
        "vulnerability_name",
        "severity",
        "cvss"
    ]

    with output.open(
        "w",
        encoding="utf-8",
        newline=""
    ) as file:

        writer = csv.DictWriter(
            file,
            fieldnames=fields,
            extrasaction="ignore"
        )

        writer.writeheader()

        writer.writerows(
            records
        )

66 — Export Owner Remediation Report

Create:

def export_owner_report(
    findings
):
    output = (
        REPORT_DIR /
        "owner-remediation-summary.csv"
    )

    owner_data = defaultdict(
        lambda: {
            "open_findings": 0,
            "critical": 0,
            "p1": 0,
            "overdue": 0
        }
    )

    for item in findings:
        if item[
            "status"
        ] != "open":
            continue

        owner = (
            item["owner"]
            or "Unassigned"
        )

        owner_data[
            owner
        ][
            "open_findings"
        ] += 1

        if item[
            "severity"
        ] == "critical":
            owner_data[
                owner
            ][
                "critical"
            ] += 1

        if item[
            "priority"
        ] == "P1":
            owner_data[
                owner
            ][
                "p1"
            ] += 1

        if item[
            "overdue"
        ]:
            owner_data[
                owner
            ][
                "overdue"
            ] += 1

    with output.open(
        "w",
        encoding="utf-8",
        newline=""
    ) as file:

        writer = csv.writer(
            file
        )

        writer.writerow([
            "owner",
            "open_findings",
            "critical_findings",
            "p1_findings",
            "overdue_findings"
        ])

        for owner, data in sorted(
            owner_data.items()
        ):
            writer.writerow([
                owner,
                data[
                    "open_findings"
                ],
                data[
                    "critical"
                ],
                data[
                    "p1"
                ],
                data[
                    "overdue"
                ]
            ])

67 — Export JSON

Create:

def export_json(
    results,
    summary
):
    output = (
        REPORT_DIR /
        "vulnerability-analysis.json"
    )

    data = {
        "reference_date":
            str(
                REFERENCE_DATE
            ),

        "summary":
            summary,

        "findings":
            results[
                "findings"
            ],

        "invalid":
            results[
                "invalid"
            ],

        "duplicates":
            results[
                "duplicates"
            ]
    }

    with output.open(
        "w",
        encoding="utf-8"
    ) as file:

        json.dump(
            data,
            file,
            indent=2,
            default=str
        )

68 — Generate the Markdown Report

Create:

def generate_markdown_report(
    results,
    summary
):
    findings = results[
        "findings"
    ]

    queue = (
        build_remediation_queue(
            findings
        )
    )

    lines = []

    lines.append(
        "# Vulnerability Prioritization Report"
    )

    lines.append("")

    lines.append(
        f"Reference Date: {REFERENCE_DATE}"
    )

    lines.append("")

    lines.append(
        "## Executive Summary"
    )

    lines.append("")

    lines.append(
        f"- Open findings: "
        f"{summary['open_findings']}"
    )

    lines.append(
        f"- Critical open findings: "
        f"{summary['critical_open']}"
    )

    lines.append(
        f"- Overdue findings: "
        f"{summary['overdue']}"
    )

    lines.append(
        f"- Internet-exposed findings: "
        f"{summary['internet_exposed']}"
    )

    lines.append(
        f"- Open findings without owner: "
        f"{summary['unowned_open']}"
    )

    lines.append(
        f"- Duplicate findings removed: "
        f"{summary['duplicates_removed']}"
    )

    lines.append(
        f"- Invalid findings rejected: "
        f"{summary['invalid_findings']}"
    )

    lines.append("")

    lines.append(
        "## Highest Priority Remediation"
    )

    lines.append("")

    for item in queue[:10]:
        lines.append(
            f"- {item['priority']} | "
            f"{item['hostname']} | "
            f"{item['vulnerability_name']} | "
            f"Score {item['priority_score']} | "
            f"Owner: {item['owner'] or 'Unassigned'}"
        )

    lines.append("")

    lines.append(
        "## Overdue Findings"
    )

    lines.append("")

    overdue = overdue_findings(
        findings
    )

    if overdue:
        for item in sort_findings(
            overdue
        ):
            lines.append(
                f"- {item['hostname']} | "
                f"{item['vulnerability_name']} | "
                f"{item['days_overdue']} days overdue"
            )
    else:
        lines.append(
            "- No overdue findings."
        )

    lines.append("")

    lines.append(
        "## Unmapped Assets"
    )

    lines.append("")

    unmapped = get_unmapped_findings(
        findings
    )

    if unmapped:
        for item in unmapped:
            lines.append(
                f"- {item['hostname']} | "
                f"{item['vulnerability_name']}"
            )
    else:
        lines.append(
            "- No unmapped assets."
        )

    lines.append("")

    lines.append(
        "## Analyst Guidance"
    )

    lines.append("")

    lines.append(
        "Priority scores in this lab are training values. "
        "Validate remediation urgency using asset criticality, "
        "exposure, threat intelligence, exploitability, business "
        "impact, compensating controls, and change-management "
        "requirements before making production decisions."
    )

    output = (
        REPORT_DIR /
        "vulnerability-prioritization-report.md"
    )

    output.write_text(
        "\n".join(
            lines
        ),
        encoding="utf-8"
    )

69 — Create `main()`

Add:

def main():
    results = process_findings()

    summary = build_summary(
        results
    )

    export_remediation_queue(
        results[
            "findings"
        ]
    )

    export_invalid_findings(
        results[
            "invalid"
        ]
    )

    export_duplicates(
        results[
            "duplicates"
        ]
    )

    export_unmapped_findings(
        results[
            "findings"
        ]
    )

    export_owner_report(
        results[
            "findings"
        ]
    )

    export_json(
        results,
        summary
    )

    generate_markdown_report(
        results,
        summary
    )

    print(
        "Vulnerability analysis complete."
    )

    print(
        f"Reports saved to: "
        f"{REPORT_DIR}"
    )

70 — Add the Entry Point

Add:

if __name__ == "__main__":
    main()

71 — Run the Complete Tool

Run:

python src/vulnerability_analyzer.py

Expected:

Vulnerability analysis complete.
Reports saved to: ...

72 — Review the Output Files

You should now have:

reports/
|
+-- remediation-queue.csv
|
+-- invalid-findings.csv
|
+-- duplicate-findings.csv
|
+-- unmapped-assets.csv
|
+-- owner-remediation-summary.csv
|
+-- vulnerability-analysis.json
|
+-- vulnerability-prioritization-report.md

73 — Review the Remediation Queue

The queue should place the most important open findings near the top.

Example:

P1 WEB01 Outdated Web Framework

P1 VPN01 Remote Access Security Update

P1 DB01 Missing Security Update

P1/P2 OLD01 Legacy Service Exposure

Exact priority may depend on your calculated score.

74 — Important Lesson About CVSS

Do not prioritize only by:

CVSS

Compare:

CVSS 9.8
on development system

with:

CVSS 8.1
on internet-facing critical production system

Risk context can change urgency.

75 — Risk Context Model

TECHNICAL SEVERITY
        +
ASSET CRITICALITY
        +
EXPOSURE
        +
THREAT CONTEXT
        +
AGE
        +
OWNERSHIP
        =
REMEDIATION PRIORITY

76 — Add Severity Statistics

Example:

summary = count_by_severity(
    results["findings"]
)

print(summary)

Expected structure:

{
    "critical": 4,
    "high": 3,
    "medium": 1
}

Exact counts depend on deduplication and open status.

77 — Add Priority Statistics

Example:

print(
    count_by_priority(
        results["findings"]
    )
)

This helps produce:

P1 COUNT

P2 COUNT

P3 COUNT

P4 COUNT

78 — Build an SLA Model

A real organization may define:

CRITICAL
15 days

HIGH
30 days

MEDIUM
60 days

LOW
90 days

For the lab, treat existing:

remediation_due_date

as the approved SLA-derived deadline.

79 — SLA Compliance Metric

Create:

def sla_compliance(
    findings
):
    open_items = [
        item
        for item in findings
        if item[
            "status"
        ] == "open"
    ]

    if not open_items:
        return 100.0

    compliant = [
        item
        for item in open_items
        if not item[
            "overdue"
        ]
    ]

    return round(
        100.0 *
        len(compliant)
        /
        len(open_items),
        2
    )

80 — Why SLA Metrics Matter

Leadership may ask:

WHAT PERCENTAGE OF OPEN FINDINGS
ARE WITHIN REMEDIATION SLA?

This is different from:

HOW MANY FINDINGS EXIST?

81 — Add SLA Metric to Summary

Include:

"open_sla_compliance_percentage":
    sla_compliance(
        findings
    )

82 — Age Buckets

Create:

def age_bucket(
    days
):
    if days is None:
        return "unknown"

    if days <= 30:
        return "0-30"

    if days <= 60:
        return "31-60"

    if days <= 90:
        return "61-90"

    return "90+"

83 — Why Age Buckets Matter

A vulnerability management dashboard might show:

0–30 DAYS

31–60 DAYS

61–90 DAYS

90+ DAYS

Large numbers in:

90+

may indicate remediation backlog.

84 — Add Age Bucket to Findings

Inside time enrichment:

item[
    "age_bucket"
] = age_bucket(
    item[
        "finding_age_days"
    ]
)

85 — Count Findings by Age Bucket

Create:

def count_by_age_bucket(
    findings
):
    return Counter(
        item[
            "age_bucket"
        ]
        for item in findings
        if item[
            "status"
        ] == "open"
    )

86 — Owner Accountability

A mature remediation queue should answer:

WHO NEEDS TO ACT?

not only:

WHAT IS VULNERABLE?

87 — Owner Summary Mental Model

FINDING
  ↓
ASSET
  ↓
OWNER
  ↓
PRIORITY
  ↓
DUE DATE
  ↓
REMEDIATION ACTION

88 — Missing Owner Escalation

If:

OWNER = EMPTY

do not simply discard the finding.

Create:

OWNERSHIP REVIEW

because unowned systems can become unmanaged risk.

89 — Data Quality Matters

Your pipeline already detects:

INVALID CVSS

UNMAPPED ASSET

DUPLICATE FINDING

A mature program should also detect:

MISSING HOSTNAME

INVALID DATE

UNKNOWN SEVERITY

MISSING FINDING ID

MISSING OWNER

UNKNOWN ENVIRONMENT

90 — Add Logging

Import:

import logging

Configure:

logging.basicConfig(
    level=logging.INFO,
    format=(
        "%(asctime)s "
        "%(levelname)s "
        "%(message)s"
    )
)

91 — Add Pipeline Logging

Example:

logging.info(
    "Loading asset inventory"
)

logging.info(
    "Loading vulnerability data"
)

logging.info(
    "Deduplicating findings"
)

logging.info(
    "Generating remediation reports"
)

92 — Do Not Log Sensitive Data Needlessly

Real vulnerability records may reveal:

INTERNAL HOSTNAMES

IP ADDRESSES

SYSTEM OWNERS

SECURITY WEAKNESSES

BUSINESS SYSTEMS

Treat vulnerability reports as sensitive security information.

93 — Add Command-Line Arguments

Import:

import argparse

Create:

def get_arguments():
    parser = argparse.ArgumentParser(
        description=(
            "Analyze vulnerability scanner "
            "exports and build a remediation queue."
        )
    )

    parser.add_argument(
        "--vulnerabilities",
        default=str(
            VULNERABILITY_FILE
        ),
        help="Path to vulnerability CSV"
    )

    parser.add_argument(
        "--assets",
        default=str(
            ASSET_FILE
        ),
        help="Path to asset inventory CSV"
    )

    return parser.parse_args()

94 — Future Input Flexibility

Eventually you could run:

python src/vulnerability_analyzer.py \
  --vulnerabilities data/weekly-scan.csv \
  --assets data/cmdb-export.csv

95 — Safe Automation Principle

The tool should:

ANALYZE

PRIORITIZE

REPORT

It should not automatically:

PATCH SYSTEMS

SHUT DOWN SERVERS

DISABLE SERVICES

CHANGE FIREWALL RULES

without approved remediation workflows.

96 — Vulnerability Management Workflow

DISCOVER
   ↓
VALIDATE
   ↓
NORMALIZE
   ↓
DEDUPLICATE
   ↓
ENRICH
   ↓
PRIORITIZE
   ↓
ASSIGN OWNER
   ↓
REMEDIATE
   ↓
VERIFY
   ↓
CLOSE

97 — Remediation Is Not Closure

A vulnerability should not be considered closed because someone says:

PATCH APPLIED

You should ideally:

RESCAN

VERIFY

CONFIRM FINDING NO LONGER EXISTS

98 — Add Verification Status Concept

A production schema might contain:

status

remediation_status

verification_status

Example:

Open
→ Remediation In Progress
→ Pending Verification
→ Verified Closed

99 — Risk Acceptance Concept

Not every vulnerability can be immediately remediated.

Possible handling includes:

REMEDIATE

MITIGATE

ACCEPT RISK

DECOMMISSION

DEFER WITH APPROVAL

100 — Risk Acceptance Requirements

Risk acceptance should include:

OWNER

BUSINESS JUSTIFICATION

EXPIRY DATE

APPROVER

COMPENSATING CONTROLS

REVIEW DATE

not simply:

WE CANNOT FIX IT

101 — False Positive Handling

Some scanner findings may be inaccurate.

Workflow:

FINDING
   ↓
VALIDATE
   ↓
FALSE POSITIVE?
   ↓
DOCUMENT EVIDENCE
   ↓
APPROVED EXCEPTION

102 — Do Not Delete False Positives Blindly

Instead retain:

WHY IT WAS CLOSED

WHO APPROVED IT

WHEN IT WAS REVIEWED

This supports auditability.

103 — Add Threat Intelligence Concept

A more advanced prioritization model could add:

KNOWN EXPLOITED?

ACTIVE CAMPAIGN?

EXPLOIT AVAILABLE?

EPSS?

Then:

VULNERABILITY
   +
THREAT CONTEXT
   =
BETTER PRIORITY

104 — Important Threat Context Rule

Even if a vulnerability is known to be actively exploited, you still need:

IS THE AFFECTED PRODUCT PRESENT?

IS THE VULNERABLE VERSION PRESENT?

IS THE SYSTEM EXPOSED?

DO COMPENSATING CONTROLS EXIST?

105 — Add Asset Tiering

Instead of only:

Critical

High

Medium

Low

some enterprises may use:

Tier 0
Identity-critical

Tier 1
Business-critical

Tier 2
Important

Tier 3
Standard

106 — Prioritization Becomes Better With Context

VULNERABILITY
      ↓
ASSET
      ↓
BUSINESS SERVICE
      ↓
DATA SENSITIVITY
      ↓
EXPOSURE
      ↓
THREAT
      ↓
OWNER
      ↓
PRIORITY

107 — Create Test Suite

Create:

tests/test_vulnerability_analyzer.py

108 — Test Severity Normalization

def test_normalize_severity():
    assert (
        normalize_severity(
            "CRITICAL"
        )
        == "critical"
    )

109 — Test CVSS Validation

def test_valid_cvss():
    assert (
        parse_cvss(
            "9.8"
        )
        == 9.8
    )

110 — Test Invalid CVSS

def test_invalid_cvss():
    assert (
        parse_cvss(
            "not-a-score"
        )
        is None
    )

111 — Test Hostname Normalization

def test_hostname_normalization():
    assert (
        normalize_hostname(
            " web01 "
        )
        == "WEB01"
    )

112 — Test Boolean Parsing

def test_boolean():
    assert parse_boolean(
        "true"
    )

    assert not parse_boolean(
        "false"
    )

113 — Test Overdue Logic

Example:

def test_overdue():
    finding = {
        "status": "open",
        "remediation_due_date":
            date(
                2026,
                8,
                15
            )
    }

    assert is_overdue(
        finding
    )

114 — Test Closed Finding

def test_closed_not_overdue():
    finding = {
        "status": "closed",
        "remediation_due_date":
            date(
                2026,
                7,
                1
            )
    }

    assert not is_overdue(
        finding
    )

115 — Test Deduplication

Provide two:

WEB01
+
Outdated Web Framework
+
Open

records.

Verify:

UNIQUE = 1

DUPLICATE = 1

116 — Test Unknown Asset

Ensure:

UNKNOWN01

receives:

asset_mapped = False

117 — Test Priority Score

Create a synthetic finding with:

critical severity

critical asset

CVSS 9.8

internet exposed

overdue

Verify that it receives:

P1

under your training model.

118 — Challenge 01 — Add CVE

Add a field:

cve

to the scanner export.

Then use it as part of your deduplication logic.

119 — Challenge 02 — Add Port

Add:

port

and:

protocol

This helps distinguish the same finding across different services.

120 — Challenge 03 — Add Business Service

Update:

assets.csv

with:

business_service

Examples:

Customer Portal

Payments

Identity

Corporate VPN

121 — Challenge 04 — Add Data Classification

Add:

data_classification

such as:

Public

Internal

Confidential

Restricted

Then adjust priority.

122 — Challenge 05 — Add Exploitability Context

Use synthetic data:

known_exploited

exploit_available

Do not use this as proof of compromise.

Use it only as additional prioritization context.

123 — Challenge 06 — Add Compensating Controls

Example fields:

network_isolated

waf_protected

edr_enabled

Then ask:

SHOULD THESE LOWER PRIORITY?

BY HOW MUCH?

WHO APPROVES THAT LOGIC?

124 — Challenge 07 — Add SLA Calculations

Instead of supplying due dates manually, calculate them from:

SEVERITY

DISCOVERED DATE

SLA POLICY

Example training values:

Critical
15 days

High
30 days

Medium
60 days

Low
90 days

125 — Challenge 08 — Add Owner-Specific Reports

Generate:

Web-Team.csv

Database-Team.csv

Network-Team.csv

Unassigned.csv

126 — Challenge 09 — Add HTML Dashboard

Create a simple HTML report showing:

TOTAL OPEN

P1

P2

OVERDUE

INTERNET EXPOSED

UNOWNED

TOP OWNERS

127 — Challenge 10 — Store Results in SQLite

Architecture:

SCANNER CSV
     ↓
PYTHON
     ↓
NORMALIZED FINDINGS
     ↓
SQLITE
     ↓
SQL REPORTING

This connects directly to:

Lab 05 — SQL Security Analytics

128 — Challenge 11 — Compare Two Scan Dates

Create:

scan-week-1.csv

scan-week-2.csv

Identify:

NEW FINDINGS

REMEDIATED FINDINGS

PERSISTENT FINDINGS

129 — Vulnerability Trend Model

PREVIOUS SCAN
      ↓
COMPARE
      ↓
CURRENT SCAN
      ↓
NEW
REMEDIATED
UNCHANGED

Management should not only ask:

HOW MANY VULNERABILITIES
DO WE HAVE?

Also ask:

ARE WE GETTING BETTER?

ARE FINDINGS AGING?

ARE P1 ITEMS CLOSING?

IS THE BACKLOG GROWING?

131 — Challenge 12 — Mean Time to Remediate

If you add:

closed_date

you can calculate:

MTTR

Conceptually:

CLOSED DATE
-
DISCOVERED DATE
=
REMEDIATION TIME

132 — Vulnerability Management Metrics

Useful metrics may include:

OPEN FINDINGS

CRITICAL OPEN

P1 OPEN

OVERDUE

SLA COMPLIANCE

UNOWNED FINDINGS

INTERNET-EXPOSED FINDINGS

90+ DAY FINDINGS

MEAN TIME TO REMEDIATE

REOPENED FINDINGS

133 — Be Careful With Metrics

Metrics can drive bad behavior if poorly designed.

Example:

GOAL:
REDUCE VULNERABILITY COUNT

could encourage teams to close:

LOW-RISK EASY FINDINGS

while ignoring:

HIGH-RISK DIFFICULT FINDINGS

Measure:

RISK REDUCTION

not only:

TICKET VOLUME

134 — Analyst Investigation Exercise 01

You find:

WEB01

Critical vulnerability

CVSS 9.8

Internet exposed

14 days overdue

What should happen?

Review:

VALIDATE FINDING

CONFIRM AFFECTED VERSION

CHECK EXPOSURE

CHECK COMPENSATING CONTROLS

CONTACT OWNER

PRIORITIZE CHANGE

REMEDIATE

RESCAN

135 — Analyst Investigation Exercise 02

You find:

OLD01

Critical vulnerability

No asset owner

Production

High criticality

The vulnerability is important.

But there is also a:

GOVERNANCE FAILURE

because nobody owns the system.

136 — Analyst Investigation Exercise 03

You find:

UNKNOWN01

High severity

CVSS 8.0

Asset not in inventory

Possible response:

VERIFY HOSTNAME

SEARCH CMDB

CHECK SCANNER ASSET ID

CHECK WHETHER SYSTEM WAS DECOMMISSIONED

IDENTIFY OWNER

DO NOT DISCARD THE FINDING

137 — Analyst Investigation Exercise 04

A finding has:

CVSS 9.8

but the asset is:

Development

Not internet exposed

Short-lived lab system

Should it automatically be the organization’s top risk?

Not necessarily.

Context matters.

138 — Analyst Investigation Exercise 05

A finding has:

CVSS 7.5

on:

JUMP01

Critical administrative host

It may deserve greater attention than raw CVSS suggests because of:

ASSET ROLE

139 — Vulnerability Prioritization Mental Model

DO NOT ASK ONLY:

"HOW SEVERE IS
THE VULNERABILITY?"

ALSO ASK:

"WHERE IS IT?"

"WHAT DOES THE ASSET DO?"

"WHO OWNS IT?"

"IS IT EXPOSED?"

"HOW OLD IS IT?"

"IS IT BEING EXPLOITED?"

"WHAT CONTROLS EXIST?"

140 — Build the Final Portfolio Structure

Your final repository should look like:

vulnerability-prioritization/
|
+-- data/
|   +-- assets.csv
|   +-- vulnerabilities.csv
|
+-- src/
|   +-- vulnerability_analyzer.py
|
+-- tests/
|   +-- test_vulnerability_analyzer.py
|
+-- reports/
|   +-- remediation-queue.csv
|   +-- invalid-findings.csv
|   +-- duplicate-findings.csv
|   +-- unmapped-assets.csv
|   +-- owner-remediation-summary.csv
|   +-- vulnerability-analysis.json
|   +-- vulnerability-prioritization-report.md
|
+-- README.md
|
+-- architecture.md

141 — README Structure

Include:

PROJECT OVERVIEW

SECURITY PROBLEM

ARCHITECTURE

INPUT DATA

NORMALIZATION

DEDUPLICATION

ASSET ENRICHMENT

RISK MODEL

OUTPUT REPORTS

HOW TO RUN

TESTING

SECURITY CONSIDERATIONS

LIMITATIONS

FUTURE IMPROVEMENTS

142 — Document Your Risk Formula

Be transparent.

Do not simply output:

Risk Score = 114

without explaining where it came from.

Document:

Severity weight

Asset criticality weight

CVSS contribution

Internet exposure weight

Overdue weight

Missing-owner weight

143 — Why Explainability Matters

Security teams need to understand:

WHY DID THIS FINDING
BECOME P1?

A transparent model supports:

AUDITABILITY

TRUST

TUNING

GOVERNANCE

144 — Common Vulnerability Management Mistakes

Avoid:

PRIORITIZING ONLY BY CVSS

NO ASSET CONTEXT

NO OWNERSHIP DATA

NO DEDUPLICATION

NO SLA TRACKING

IGNORING OLD FINDINGS

IGNORING UNKNOWN ASSETS

COUNTING CLOSED ITEMS AS ACTIVE RISK

NO FALSE-POSITIVE PROCESS

NO VERIFICATION AFTER REMEDIATION

AUTOMATICALLY PATCHING WITHOUT CHANGE CONTROL

NO DOCUMENTED RISK MODEL

145 — Data Pipeline Mistakes

Avoid:

TRUSTING EVERY CSV FIELD

CRASHING ON ONE BAD RECORD

SILENTLY DISCARDING INVALID DATA

CASE-SENSITIVE HOSTNAME MISMATCHES

BAD DATE PARSING

NO DUPLICATE HANDLING

NO REPORT VERSIONING

NO LOGGING

146 — Mission Validation Checklist

Confirm:

Mission Review

You started with:

RAW VULNERABILITY
SCANNER DATA

containing:

DUPLICATES

BAD DATA

SEVERITY

CVSS

DATES

HOSTNAMES

You transformed it into:

SCANNER FINDING
      ↓
VALIDATE
      ↓
NORMALIZE
      ↓
DEDUPLICATE
      ↓
MAP ASSET
      ↓
ADD BUSINESS CONTEXT
      ↓
CHECK EXPOSURE
      ↓
CHECK AGE / SLA
      ↓
CALCULATE PRIORITY
      ↓
ASSIGN OWNER
      ↓
REMEDIATION QUEUE

What You Built

You now have a vulnerability management analytics workflow capable of answering:

WHAT SHOULD WE FIX FIRST?

WHICH FINDINGS ARE OVERDUE?

WHICH CRITICAL ASSETS ARE AFFECTED?

WHICH INTERNET-EXPOSED ASSETS ARE VULNERABLE?

WHICH FINDINGS HAVE NO OWNER?

WHICH SCANNER RECORDS ARE DUPLICATES?

WHICH ASSETS ARE MISSING FROM INVENTORY?

Key Security Lesson

The central lesson is:

VULNERABILITY
SEVERITY
IS NOT THE SAME AS
BUSINESS RISK

A useful remediation decision requires:

TECHNICAL SEVERITY
       +
ASSET CRITICALITY
       +
EXPOSURE
       +
THREAT CONTEXT
       +
AGE
       +
OWNERSHIP
       +
BUSINESS IMPACT
       =
REMEDIATION PRIORITY

Final Mental Model

Whenever vulnerability data arrives, think:

IS THE DATA VALID?
      ↓
IS IT A DUPLICATE?
      ↓
WHICH ASSET IS AFFECTED?
      ↓
HOW CRITICAL IS THE ASSET?
      ↓
IS IT EXPOSED?
      ↓
HOW SEVERE IS THE FINDING?
      ↓
HOW OLD IS IT?
      ↓
IS IT OVERDUE?
      ↓
WHO OWNS IT?
      ↓
WHAT SHOULD BE FIXED FIRST?
      ↓
HOW WILL WE VERIFY CLOSURE?

The goal is not:

GENERATE A LONGER
VULNERABILITY REPORT

The goal is:

TURN SCANNER DATA
INTO A PRIORITIZED,
OWNED,
TRACKABLE
REMEDIATION PROGRAM

What’s Next?

➡️ Lab 07 — Security API Integration

The next lab moves from local CSV-based vulnerability analysis into external security-system integration.

You will build:

SECURITY AUTOMATION
       ↓
API CLIENT
       ↓
AUTHENTICATION
       ↓
REQUEST
       ↓
TIMEOUT
       ↓
RESPONSE VALIDATION
       ↓
JSON PARSING
       ↓
ERROR HANDLING
       ↓
RETRY
       ↓
RATE LIMIT AWARENESS
       ↓
NORMALIZED SECURITY DATA

You will use a controlled training API or local mock service to learn how security tools exchange data safely without hard-coding secrets or depending on uncontrolled external systems.

Lab 06 — Vulnerability Data Analysis and Prioritization

Mission Information

Mission

Why This Lab Matters

Learning Objectives

Final Architecture

Authorization and Safety

01 — Create the Lab Workspace

02 — Verify Python

03 — Create the Asset Inventory

04 — Understand the Asset Context

05 — Create the Vulnerability Export

06 — Why This Dataset Is Useful

07 — Create the Python Script

08 — Define Project Paths

09 — Define the Lab Reference Date

Why Use a Fixed Date?

10 — Normalize Boolean Values

11 — Normalize Severity

12 — Why Normalize Severity?

13 — Parse CVSS Safely

14 — Why Validate CVSS?

15 — Parse Dates

16 — Normalize Hostnames

17 — Load the Asset Inventory

18 — Test Asset Loading

19 — Required Vulnerability Fields

20 — Validate CSV Schema

21 — Load Vulnerability Data

22 — Create the Finding Normalizer

23 — Test Vulnerability Loading

24 — Deduplication Strategy

25 — Build the Deduplication Key

26 — Deduplicate Findings

27 — Why Deduplication Matters

28 — Deduplication Limitation

29 — Enrich Findings with Asset Data

30 — Why Asset Mapping Matters

31 — Find Unmapped Assets

32 — Why Unmapped Assets Matter

33 — Determine Overdue Status

34 — Add Days Overdue

35 — Add Finding Age

36 — Why Age Matters

37 — Add Time Context

38 — Build the Risk Model

39 — Important Risk Warning

40 — Criticality Weight

41 — Severity Weight

42 — Build Priority Score

43 — Example Priority Calculation

44 — Priority Categories

45 — Priority Meaning

46 — Add Priority Context

47 — Build the Complete Processing Pipeline

48 — Test the Pipeline

49 — Sort by Priority Score

50 — Build the Remediation Queue

51 — Expected High-Priority Findings

52 — Why WEB01 Should Rank Highly

53 — Why OLD01 Deserves Attention

54 — Vulnerabilities Without Owners

55 — Internet-Exposed Findings

56 — Overdue Findings

57 — Critical Open Findings

58 — Count Findings by Severity

59 — Count Findings by Owner

60 — Count Findings by Priority

61 — Build a Vulnerability Summary

62 — Export the Remediation Queue

63 — Export Invalid Findings

64 — Export Duplicate Findings

65 — Export Unmapped Assets

66 — Export Owner Remediation Report

67 — Export JSON

68 — Generate the Markdown Report

69 — Create main()

70 — Add the Entry Point

71 — Run the Complete Tool

72 — Review the Output Files

69 — Create `main()`