Something I've always been curious about when it comes to DevSecOps workflows:

How do teams realistically decide which vulnerabilities to fix first?

In theory the answer is obvious — fix the critical stuff immediately.

But in practice most pipelines end up producing a lot of findings. Dependency vulnerabilities, SAST alerts, secrets scans, container issues… it adds up pretty quickly.

What I’ve seen on a few projects is that teams end up doing something like:

• fix the critical ones if they look exploitable

• maybe tackle some highs if there’s time

• everything else just sits in the backlog

And after a few months you suddenly have hundreds of findings across repos and nobody really knows where to start.

I’m curious how other teams handle this in reality.

Do you:

• strictly follow CVSS scores
• prioritize based on exploitability / reachability
• focus on dependencies first
• just fix things as they come up

Or does it mostly become security debt that gets cleaned up occasionally?

Would be interesting to hear how different teams approach this.