Why do exposure tickets stall?
Because they arrive at someone who did not ask for them. The owner of a forgotten marketing server, or the IT lead at a subsidiary, receives a ticket from a tool they have never heard of, about an asset they may not recognise. If the ticket does not answer their first three questions, it waits.
The seven fields
- Asset and ownership evidence. The hostname or address, and why it is attributed to this owner: the registration, certificate, cloud account or business unit link. Tools that keep a trace of how each asset was attributed make this field easy.
- What was found. One sentence, in plain words, then the technical detail.
- Proof. The evidence that the weakness is exploitable, not only present: the request and response, or the test result. Lesson 4 covers how tools produce it.
- Why it matters now. Context such as an entry in the CISA KEV catalog, an EPSS score or the data behind the service.
- What to do. The fix, and any compensating control already in place, with its expiry date.
- Deadline. A date, set by a rule the owner can look up.
- How it will be checked. Who retests, and when.
How should deadlines be set?
Use a written rule rather than a negotiation per ticket. The CISA KEV catalog is a useful model: CISA's Binding Operational Directive 22-01 requires U.S. federal civilian agencies to remediate catalog vulnerabilities within set timeframes, and CISA recommends that every organization include a requirement to immediately address KEV vulnerabilities in its vulnerability management plan. A simple internal rule might set the shortest deadline for proven exposures with a KEV entry, and longer ones for proven exposures without.
What do tools document?
Most tools here create or route tickets. The difference is what travels with them.
- CyCognito describes step-by-step guidance, owner-linked workflows into ServiceNow, Jira, Splunk and Zendesk, and a retest after the fix.
- Hadrian describes remediation guidance, automatic ticket creation and automatic regression testing.
- Censys describes auto-creating, routing and tracking remediation tasks.
- watchTowr names eight ticketing and workflow tools, including Atlassian, ServiceNow and PagerDuty.
What makes owners trust the next ticket?
Accuracy. Every ticket about an asset that turns out not to be theirs, or a weakness that turns out not to be real, makes the next one slower. That is the practical reason to weight proof and attribution above raw discovery, as this site does.