A vulnerability dashboard can show thousands of findings without telling a service owner what to fix first. The useful unit of work is a decision tied to an affected resource, a responsible team, a deadline, and a way to confirm that the exposure has changed.
The operating decision
Turn findings into work that someone can finish
Amazon Inspector supplies vulnerability and network-exposure findings for supported workloads. Security Hub CSPM brings findings and posture checks together. Security Hub exposure findings add correlation across security signals and resource relationships. These capabilities support prioritization, but an organization still has to decide who acts and what constitutes an acceptable outcome.
Consider the same vulnerable package on two systems: an internet-facing application with access to sensitive records and an isolated test instance scheduled for retirement. Both deserve review. Their remediation sequence may differ because their exposure and consequences differ. A severity label starts that analysis; it does not complete it.
A finding becomes operational when a named owner can explain the risk, the next action, and the evidence required to close it.TDG perspective
Product surface
Keep the services and their decisions distinct
The AWS services contribute different evidence. Treating them as interchangeable makes coverage and ownership harder to explain.
Amazon Inspector
Discovers and assesses eligible EC2 instances, ECR container images, and Lambda functions. Supported scan types and prerequisites vary by resource.
Inspector scoring
Provides vulnerability context and, where supported, an environment-adjusted Inspector score. Read the underlying finding rather than treating the score as a complete business-risk calculation.
Security Hub CSPM
Aggregates security findings and evaluates supported security controls. Inspector can send findings to it using the AWS Security Finding Format.
Security Hub exposures
Correlates vulnerabilities, configurations, threats, and resource relationships into exposure findings. Confirm availability and configuration for the target environment.
Event routing
Inspector publishes finding events to Amazon EventBridge. Routing can connect events to an existing ticketing or response workflow.
Organizational management
Delegated administration and account enrollment support central oversight. Teams must still verify account, Region, resource, and scan-type coverage.
Coverage first
Prove what is being assessed
An empty findings view may mean a resource is healthy, unsupported, excluded, or not being scanned. Establish a coverage register before using finding counts as evidence of progress.
| Coverage question | Evidence to retain |
|---|---|
| Which accounts and Regions matter? | Expected account and Region inventory matched to service enrollment. |
| Which resources are eligible? | EC2, ECR, and Lambda inventory mapped to supported scan types and prerequisites. |
| Which resources are unassessed? | Coverage status, reason, responsible team, and recovery date. |
| Which images reach production? | Deployed image digests matched to assessed images and their current findings. |
Include short-lived workloads and images built outside the standard pipeline. Review coverage when accounts are added, base images change, or a team adopts a new deployment path. A remediation program cannot compensate for an unknown assessment boundary.
Triage criteria
Prioritize the exposure and its consequence
Use a repeatable decision record so that two analysts looking at the same resource can explain why its position in the queue changed.
| Decision input | Practical question | Resulting action |
|---|---|---|
| Threat evidence | Is there evidence of exploitation or suspicious activity? | Escalate to incident response when warranted; patching alone may be insufficient. |
| Reachability | Can an attacker reach the vulnerable component through an actual path? | Validate network and application context; reduce exposure while a durable fix is prepared. |
| Mission consequence | What service, data, privilege, or downstream dependency could be affected? | Set priority with the service owner and record the consequence. |
| Fix and constraints | Is a patch available, compatible, and deployable? | Choose patching, rebuild, replacement, isolation, or a documented temporary control. |
Do not let missing business context silently lower priority. Route unknown ownership or criticality for resolution. Use current threat and exploitation information where available, and revisit decisions when that evidence changes.
Operating model
Use one owned remediation record
Connect related observations to a work item without losing the original finding identifiers. A service team should not receive separate tickets for every duplicate signal when one base-image rebuild addresses the shared cause.
Assign
Route by account, resource, application, and service ownership. Give unmapped resources a named escalation owner.
Decide
Record the affected version, exposure, consequence, action, and policy-based response deadline.
Change
Patch or rebuild through the approved delivery path. Retain the change record and test evidence.
Verify
Reassess the affected resource. For images, confirm the corrected digest is deployed and vulnerable instances are replaced.
Handle exceptions
Require an approver, bounded scope, compensating controls, expiration, and a reassessment trigger.
Review recurrence
Track repeated vulnerable builds, reopened findings, stale exceptions, and coverage gaps so the underlying delivery problem gets corrected.
Practical boundaries
Separate a quieter dashboard from a safer service
A suppression rule changes visibility. It does not remove a vulnerable package. Likewise, a workflow status can describe an analyst decision without proving that the underlying condition is gone.
Inspector can detect remediation and close findings when it observes that the condition has been addressed. Retain that evidence alongside the resource identity and change record. If a resource disappears, distinguish verified retirement from an unexplained loss of visibility. Track ticket closure and technical remediation as separate events until both are confirmed.
Measure time to ownership, overdue exposure by criticality, verified remediation, exception age, recurrence, and assessment coverage. Raw finding volume is useful for workload planning, but it is a weak measure of risk reduction on its own.
Leadership questions
Questions to resolve before expanding automation
Automating an unclear process can distribute unclear decisions faster.
- Question 01 Who owns resources that have no application or service mapping?
- Question 02 Which evidence changes a finding from routine remediation to incident response?
- Question 03 Who approves exceptions, and what happens when they expire?
- Question 04 How is a corrected image linked to the workload that actually runs?
- Question 05 What proof is required before the work item and finding are considered resolved?
Selected references
Primary guidance informing this article
Coming next in the series
Infrastructure-as-Code Security: Where Checkov Fits
The next field review examines where infrastructure scanning belongs in the delivery process and what a passing check can actually prove.
