Guides

What to fix first

You have a list. This is how to turn it into an order.

Do not start with severity

Sorting by severity feels right and is usually wrong for the first week. A "critical" that appears once on a host nobody can reach is worth less of your afternoon than a "medium" that appears on sixty hosts and is closed by one configuration change.

Severity tells you how bad a thing is if exploited. It does not tell you how much of your estate you can clear in an hour.

Start with what one fix closes

The Exposures surface is already ordered this way: by how many hosts a single fix removes. The top row is usually the best use of your time on day one, and it is frequently something unglamorous — a missing header applied estate-wide, a certificate practice, a default configuration repeated across a fleet.

Work down from the top and re-check after each pass. A single change can remove dozens of rows at once, which reorders everything below it.

Then the things that are genuinely exposed

Once the broad sweeps are done, shift to what is actually reachable and actually yours:

  1. Exposed — reachable from the internet right now.
  2. Controls missing — a protection that should be present and is not.
  3. Recorded facts — inventory, not problems. These do not need fixing; they need to be correct. Read them, confirm they are yours, move on.

That third category surprises people. A large part of a first scan is us telling you what exists, not what is wrong. Treating inventory as a backlog is the fastest way to feel defeated by a healthy result.

Things to deprioritise honestly

  • Anything you do not own. Dismiss it as not-yours rather than not-a-risk, so the scope improves instead of the judgement.
  • Registered-but-unused lookalike domains. Watch them. Chasing every speculative registration is a full-time job with no security outcome.
  • Findings on systems already scheduled for decommission. Note the date and move on.

Reconciling with your own risk process

Our ordering optimises for estate closed per unit of effort. Your organisation may weigh a specific system far more heavily than we can know — a payment path, a regulated database, a customer-facing login.

Mark those assets as critical. The ranking then reflects your judgement as well as our arithmetic, instead of you re-sorting by hand every week.

When the score moves the wrong way

A score that gets worse after you have fixed things is usually coverage improving, not posture degrading: a check that previously could not run now can, and it found something real that was always there.

This is worth understanding before you report it to anyone, because it is the single most confusing thing a security score does. See Coverage honesty, and Reporting to your board for how to explain it.

Next