Question 1

Does ZelarTrust run vulnerability scanning under this service?

Accepted Answer

This service governs prioritisation, ownership and reporting of vulnerability and threat data — it does not replace your scanning tooling. Findings from your existing or newly deployed scanners feed into the governed programme.

Question 2

How are findings prioritised?

Accepted Answer

By actual business risk — combining severity, exploitability, asset criticality and relevant threat intelligence — rather than ranking purely on a raw severity score.

Question 3

What happens if a finding can't be remediated on schedule?

Accepted Answer

It goes through a formal exception and risk-acceptance process, documented and reviewed on a set cadence rather than left open and untracked.

Question 4

How is exposure reported to leadership?

Accepted Answer

Exposure posture, remediation progress and open exceptions are reported into the same governance cadence as the rest of your CISOaaS programme, in executive-ready terms.