Usually it'll be the other way around, a scanner will have a list of known CVEs and how to test for them. It will then give you a filtered version of that list based on which vunerabilities apply to the system under test.
You are the vendor, so you make the rules. Just be clear about them.
Problem is we only have a limited overall budget and dont want to promise anything we cannot pay.
Then be clear about that. It's not uncommon for programs to do challenges/events where they pay special rewards for e.g. the first N critical reports, or pay extra for the best report ...
For me, any of the above recommendations is a change that needs to be applied to a given application, host, etc.
Totally agree on that point, and if you have a Change Management Process, all those changes should pass through it.
how can one make sure that any of the changes does not lead to reduced or compromised security? How one can make sure that the ...
Let's take your Node.js example. You are using a version of with a known vulnerability. Therefore you have two options:
Stay on the version that you know is vulnerable
Upgrade to a version that may be vulnerable.
The only correct choice is #2. Is it possible that you are upgrading to a version that also has vulnerabilities? Absolutely! In fact that is ...
Quantifying the time to remediate is a function of the assessed risk. Risk is a function of impact and likelihood of the impact occurring. That's the general recommendation, and the organisation needs to work that out for itself.
A corporate policy helps define the default time for remedies to be applied based on the organisation's risk tolerance and the ...
I think you are asking the wrong question. Consider the following:
If you fix fewer vulnerabilities than emerge between scans, then the number of vulnerabilities will only go up (10 vulns - 3 fixes + 4 new vulns = 11)
If you do not fix all vulnerabilities, you will never get to 0
Scans can have false positives that you need to verify
Some vulnerabilities ...
Despite the continuous effort in our company to resolve vulnerabilities, we are still report a significant number of vulnerabilities after each scan we perform.
"vulnerability report by some unspecified scan thing": that's not anything I would put any weight in, unless you actually know what that "scan" does, and can categorize the vulnerability.