Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When is weekly triage necessary, and when is fortnightly enough?

3 decision pointsThe pack behind this answer: Vulnerability & Exposure Management

Add to board memo

The short answer

Recommendation
Keep triage weekly by default. Move to every two weeks only if new Priority 1 to 3 findings are few and urgent findings get an owner as soon as they appear; then change the standard first, chase everything due before the next meeting, and return to weekly if Priority 2 deadlines slip.
Reasoning
Deadlines count from first detection, not from the meeting, so every day a finding waits comes out of its fix time. A Priority 2 finding has 14 days and escalates on day 10, so one that waits up to two weeks for its first meeting is already late. Fortnightly triage is safe only when Priority 1 and 2 findings are handled between meetings. A standard that says weekly while you meet fortnightly no longer says what you actually do.
Considerations
  • The deadlines and working-day targets are the defaults in the CISO Times vulnerability pack. Your own standard may set different ones. If your shortest routine deadline is longer, the case for fortnightly is stronger.
  • The pack allows every two weeks for a small organisation with few new findings, but sets no number. A practical test is whether a two-week agenda still fits in one short meeting. If you do not know your weekly volume, stay weekly.
  • Fewer meetings does not mean fewer scans. Keep the deadlines, the closure rule and the scanning frequency unchanged.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartDeciding how often the triage meeting runsStepCount new findings after grouping them by fixDecisionAre new Priority 1 to 3 findings few each week?DecisionCan urgent findings get an owner between meetings?OutcomeKeep the triage meeting weeklyStepChange the standard to say every two weeksStepChase everything due before the next meetingDecisionAt the quarterly review, are Priority 2 deadlines slipping?OutcomeMeet every two weeks, with urgent work in between

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 9 steps.

  1. Start

    Deciding how often the triage meeting runs

    The meeting is where new findings get a confirmed priority and owner, and where late ones are chased. How often it runs decides how long a new finding can wait before anyone acts on it. Deadlines count from the day a finding was first detected, not from the meeting, so every day of waiting comes out of the fix time.

    In the pack

  2. Step

    Count new findings after grouping them by fix

    Judge volume by the tickets you would raise, not by raw scanner lines. Hundreds of new findings a week are usually one or two missing updates across many systems, and grouping by fix action turns them into a handful of tickets. Priority 4 findings go to the normal patch cycle in bulk and do not count here.

    In the pack

  3. Decision

    Are new Priority 1 to 3 findings few each week?

    The pack allows every two weeks for a small organisation with few new findings, and does not set a number. A practical test: could a two-week agenda still be worked through in one short meeting? If you do not know your weekly volume yet, stay weekly until you do.

    In the pack

  4. Decision

    Can urgent findings get an owner between meetings?

    This is the condition that makes fortnightly safe. Priority 1 findings must go to the emergency route the same working day. Priority 2 findings need an owner and a ticket within 2 working days of detection, and the day-10 escalation must go out on its date. If nobody is set up to do this between meetings, a Priority 2 finding could wait 14 days for its first discussion and already be late.

    In the pack

    See also

  5. Outcome

    Keep the triage meeting weekly

    With a Priority 2 deadline of 14 days and escalation on day 10, a weekly meeting is what keeps new findings inside their deadlines without a separate between-meetings routine. The meeting can be short: in a small team, a 15-minute call with IT.

    In the pack

    See also

  6. Step

    Change the standard to say every two weeks

    Do it before you switch, so the standard says what you actually do. Keep the deadlines and the rule for closing findings unchanged.

    In the pack

  7. Step

    Chase everything due before the next meeting

    With a two-week gap, a look-ahead of 7 days misses findings that fall due in the second week. At each meeting, chase every finding due before the next one. Scanning frequency stays as your standard sets it; fewer meetings does not mean fewer scans.

    In the pack

  8. Decision

    At the quarterly review, are Priority 2 deadlines slipping?

    Priority 2 is the priority that fortnightly triage puts under most pressure. Check deadline adherence for it, and the age of overdue Priority 2 findings, at each quarterly review. The pack treats a priority consistently below its adherence target as a sign that deadline or capacity is wrong. If you cannot tell, treat it as yes.

    In the pack

  9. Outcome

    Meet every two weeks, with urgent work in between

    Fortnightly triage is working: the standard says so, urgent findings are owned as they arrive, and deadlines are met. Revisit the choice if the volume of new findings grows.

    In the pack

Practical checklist

  1. Count new Priority 1 to 3 findings by the tickets you would raise after grouping them by fix, leaving out Priority 4.
  2. Confirm that Priority 1 findings reach the emergency route the same working day, and Priority 2 findings get an owner and a ticket within 2 working days.
  3. Confirm that day-10 escalations go out on their dates between meetings.
  4. Change the standard to say every two weeks before you switch.
  5. Chase every finding due before the next meeting at each meeting, not only those due in the next 7 days.
  6. Check Priority 2 deadline adherence and the age of overdue Priority 2 findings at each quarterly review, and return to weekly if they slip or you cannot tell.

Evidence to have ready

  • The approved standard stating the triage frequency you actually use.
  • Meeting records showing that each meeting ran and what was chased.
  • Priority 2 tickets showing owner assignment within the working-day target and escalations sent on their dates.
  • Quarterly deadline adherence for Priority 2, and the decision to keep or change the frequency.

Practitioner pulse

What other practitioners do

One question about your practice. Answer it to see how others answered. We don't ask who you are or where you work.

How often does your team meet to triage new vulnerability findings?

You can't change your answer once it's counted.

How this works

Answers are counted, not attributed: your answer adds one to the count for the option you chose, and we keep no account, IP address or organisation with it. A Cloudflare check confirms the answer comes from a person.

We discourage repeat answers from the same browser, but cannot prevent them, so treat the results as indicative. To do that, this browser remembers for 30 days that it answered this question, but not which option.

The results are the readers who chose to answer, not a survey of the profession, and the pack default is a starting point, not a norm. Results show once a question has 100 answers.

All pulse results

Assumptions

Not covered here