Triage, False Positives, and Severity Scoring with CVSS

Security tools generate more findings than any team can fix at once, mixing genuine critical flaws with false positives and low-risk noise. Triage is the discipline of turning that raw output into a prioritised, actionable list: confirming what is real, discarding what is not, and ranking the rest by risk. Without effective triage, teams either drown in alerts or, worse, ignore them all, including the ones that matter.

Analogy🏏Cricket

🍳 Think of it like cooking: A recipe can look flawless on paper, but a head chef only truly judges the dish by tasting the finished plate, because heat, timing, and the actual oven reveal problems the written method never shows. Just as tasting the cooked result catches what reading the recipe cannot, DAST probes the running application and catches the misconfigurations and runtime behaviour that reading the source cannot. This reveals DAST's stance: it judges the dish as it is actually served, not the recipe as it was merely written.

This lesson covers how to validate findings, recognise false positives, and score severity consistently using CVSS, the Common Vulnerability Scoring System. It stresses that a raw score is a starting point, not a verdict: real prioritisation weighs the vulnerability's context in your specific environment, reachability, and business impact. The aim is a repeatable process that directs limited effort to the issues that most reduce risk.

Analogy🏏Cricket

💰 Think of it like finance: A real audit that actually attempts a sample transaction proves beyond doubt whether a control can be bypassed, with little room for a false alarm, but it can only test the accounts and processes the auditors actually reach. Just as a hands-on audit yields high-confidence, low-false-positive results yet is bounded by what it examines, DAST yields high-confidence findings about real exploitability yet is bounded by the surface it can reach. This reveals its trade-off: what it confirms is solid, but it only confirms what it manages to touch.