I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades. Nevermind that the CVEs had nothing to do with your product.
My favorite urgent must fix CVE from compliance was a bug in the Linux PCMCIA driver on some EC2 VMs.
This is how Vanta et al. make millions.
My favorite urgent must fix CVE from compliance was a bug in the Linux PCMCIA driver on some EC2 VMs.