Vulnerability Tracking Guide | Track Remediation at Scale

Q: What is the best free tool for tracking vulnerability remediation?

DefectDojo is the leading open-source vulnerability management platform. It imports scan results from 150+ tools, assigns owners, tracks SLA deadlines, deduplicates findings, and auto-verifies fixes on re-scan. It replaces spreadsheets for teams of any size.

Q: How do I manage 100+ vulnerabilities without losing track?

Group vulnerabilities by remediation action instead of tracking each CVE individually. For example, 100 NGINX CVEs may only require 3 patch actions (update NGINX, update OpenSSL, change a config). This reduces your tracking workload by 90% and gives admins clear, actionable tasks.

Q: What SLA timeframes should I use for vulnerability remediation?

A common SLA framework is: Critical severity within 48 hours, High within 7 days, Medium within 30 days, and Low within 90 days. Adjust based on your organization's risk tolerance, but document the policy and enforce it consistently with automated tracking.

By FixTheVuln Team Peer-reviewed security content Sources: CISA, NIST, OWASP

Key Takeaways

Spreadsheets break down past ~50 vulnerabilities — use DefectDojo or Jira for tracking
Group vulnerabilities by remediation action, not by CVE (100 NGINX CVEs = 3 patch actions)
Define SLA deadlines: Critical 48hr, High 7d, Medium 30d, Low 90d
Always re-scan after patching to verify the fix — never close findings on trust alone
Assign every finding an owner — unowned vulnerabilities never get fixed

Why Spreadsheets Break Down

The Problem at Scale

If you're tracking vulnerabilities in Excel or Google Sheets, you will lose findings. Spreadsheets have no SLA enforcement, no deduplication, no owner assignment workflow, and no way to verify fixes automatically.

Here's what typically goes wrong when teams outgrow spreadsheets:

Problem	What Happens	Impact
No SLA tracking	Critical vulns sit for months with no escalation	Audit failures, breach risk
No deduplication	Same CVE appears 50 times across scan imports	Inflated counts, wasted effort
No owner assignment	Findings exist but nobody is accountable	Vulns never get fixed
No re-scan verification	Admin says "done" but the vuln persists	False sense of security
Manual data entry	Copy-paste errors, stale data, version conflicts	Decisions based on bad data

The real question isn't "what tool?" — it's "what workflow?" Even the best tool fails without a clear process: Discover → Prioritize → Assign → Remediate → Verify → Close.

Free Tools for Vulnerability Tracking

DefectDojo (Recommended)

DefectDojo is the leading open-source vulnerability management platform. It imports results from 150+ scanners, deduplicates findings, assigns owners, enforces SLAs, and auto-verifies fixes on re-scan.

Quick Setup

                    # Clone and start with Docker Compose
git clone https://github.com/DefectDojo/django-DefectDojo.git
cd django-DefectDojo

# Start DefectDojo (first run takes ~5 min)
docker compose up -d

# Access at http://localhost:8080
# Default credentials: admin / admin
# CHANGE THE PASSWORD IMMEDIATELY
                

Why DefectDojo Wins

Auto-import: Upload Nessus, Qualys, Burp, OWASP ZAP, Trivy, Nuclei, and 150+ other formats
Deduplication: Merges duplicate findings across multiple scans automatically
Owner assignment: Assign findings to teams or individuals with due dates
SLA enforcement: Configure per-severity deadlines with escalation alerts
Re-scan verification: Re-import a scan and DefectDojo auto-closes verified fixes
API-first: Full REST API for CI/CD integration

                    # Import scan results via API
curl -X POST "http://localhost:8080/api/v2/import-scan/" \
  -H "Authorization: Token YOUR_API_TOKEN" \
  -F "scan_type=Nessus Scan" \
  -F "file=@nessus_results.csv" \
  -F "engagement=1" \
  -F "verified=false"
                

Jira / ServiceNow Integration

If your org already uses Jira or ServiceNow, pipe scan results into your existing ticketing system instead of building a separate workflow.

Jira Approach

                    # Create Jira tickets from scan findings (Python example)
from jira import JIRA

jira = JIRA(server="https://yourorg.atlassian.net",
            basic_auth=("email", "api_token"))

for finding in critical_findings:
    jira.create_issue(
        project="VULN",
        summary=f"[{finding['severity']}] {finding['title']}",
        description=f"Asset: {finding['host']}\n"
                    f"CVE: {finding['cve']}\n"
                    f"Remediation: {finding['fix']}",
        issuetype={"name": "Bug"},
        priority={"name": "Highest"},
        assignee={"accountId": finding['owner_id']},
    )
                

Tip: DefectDojo has built-in Jira integration — it can auto-create and sync Jira tickets for every finding, giving you the best of both worlds.

OWASP Dependency-Track

For software composition analysis (SCA) specifically, Dependency-Track monitors your SBOM for new CVEs and tracks remediation status per component.

                    # Run Dependency-Track with Docker
docker compose up -d

# Upload SBOM via API
curl -X PUT "http://localhost:8081/api/v1/bom" \
  -H "X-Api-Key: YOUR_KEY" \
  -H "Content-Type: application/vnd.cyclonedx+json" \
  -d @sbom.json
                

Monitors CycloneDX and SPDX SBOMs continuously
Alerts when new CVEs affect your dependencies
Policy engine for auto-flagging based on severity, CVSS, license
Pairs well with DefectDojo for a complete vulnerability management stack

Group by Remediation Action, Not CVE

The "100 CVEs = 3 Actions" Insight

The single most impactful workflow change: Stop tracking individual CVEs and start grouping by the action that fixes them. 100 NGINX vulnerabilities usually means 3 patch actions, not 100 separate tasks.

Example: NGINX Vulnerability Report

Remediation Action	CVEs Fixed	Owner	Effort
Update NGINX to 1.27.x	72 CVEs	Infra Team	1 change window
Update OpenSSL to 3.2.x	23 CVEs	Infra Team	Same window
Disable SSLv3 / weak ciphers	5 CVEs	Security Team	Config change

When you hand an admin a spreadsheet with 100 rows of CVE-XXXX-XXXXX, they freeze. When you hand them 3 actionable tasks with clear owners, things get done.

How to Group Findings

                    # Group Nessus findings by solution (Python pseudocode)
from collections import defaultdict

groups = defaultdict(list)
for finding in scan_results:
    # Use the "solution" or "fix" field as the grouping key
    action = finding.get("solution", "Manual review needed")
    groups[action].append(finding)

for action, findings in groups.items():
    print(f"ACTION: {action}")
    print(f"  Fixes {len(findings)} CVEs")
    print(f"  Highest severity: {max(f['cvss'] for f in findings)}")
    print()
                

DefectDojo does this automatically. Its "Finding Grouping" feature clusters findings by component, CWE, or custom fields so you see actions instead of individual CVEs.

The Remediation Workflow

7-Step Lifecycle

1 Discover

2 Prioritize

3 Assign

4 Remediate

5 Re-scan

6 Verify

7 Close

Discover — Run scheduled scans (Nessus, Qualys, Trivy, etc.) and import results into your tracker
Prioritize — Rank by CVSS + asset criticality + exploitability (CISA KEV, EPSS score)
Assign — Every finding gets an owner and an SLA deadline. No owner = no accountability = no fix
Remediate — Owner applies the patch, config change, or compensating control
Re-scan — Run the same scanner against the same target to confirm the fix
Verify — Compare re-scan results. Finding gone = verified. Still present = reopen
Close — Mark as resolved with evidence (scan diff, change ticket, deployment record)

Never close a finding without re-scan verification. "The admin said they patched it" is not evidence. Scanners don't lie — re-scan and prove it.

SLA Framework

Remediation Deadlines by Severity

Severity	CVSS Range	SLA Deadline	Escalation
Critical	9.0 – 10.0	48 hours	CISO after 24hr
High	7.0 – 8.9	7 days	Director after 5d
Medium	4.0 – 6.9	30 days	Manager after 21d
Low	0.1 – 3.9	90 days	Quarterly review

CISA BOD 22-01 requires federal agencies to remediate Known Exploited Vulnerabilities (KEV) within specific timeframes. Even if you're not federal, the KEV catalog is a great prioritization signal — if CISA says it's actively exploited, fix it first.

Exception Handling

Not every vuln can be fixed on time. Document exceptions formally:

Risk acceptance: Business owner signs off that the risk is acceptable (with justification)
Compensating control: WAF rule, network segmentation, or monitoring mitigates the risk
Vendor dependency: Patch not yet available — track vendor advisory for release date
End of life: System can't be patched — create migration plan with timeline

Remediation Lifecycle Checklist

Frequently Asked Questions

What is the best free tool for tracking vulnerability remediation?

DefectDojo is the leading open-source vulnerability management platform. It imports scan results from 150+ tools, assigns owners, tracks SLA deadlines, deduplicates findings, and auto-verifies fixes on re-scan. It replaces spreadsheets for teams of any size.

How do I manage 100+ vulnerabilities without losing track?

Group vulnerabilities by remediation action instead of tracking each CVE individually. For example, 100 NGINX CVEs may only require 3 patch actions (update NGINX, update OpenSSL, change a config). This reduces your tracking workload by 90% and gives admins clear, actionable tasks.

What SLA timeframes should I use for vulnerability remediation?

A common SLA framework is: Critical severity within 48 hours, High within 7 days, Medium within 30 days, and Low within 90 days. Adjust based on your organization's risk tolerance, but document the policy and enforce it consistently with automated tracking.

Related Resources

Version-Specific Alerting Incident Response Log Management

← Back to Guides

FixTheVuln Store

Patch Tuesday Sprint Kit

Fillable PDF study planners with domain trackers, weekly schedules, and progress tracking. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.

Try Free Templates

5 fillable templates for vulnerability management — $4.99/mo

Vulnerability Tracking & Remediation