Prioritize Vulnerability Remediation with AI

Tier: Advanced · Workflow area: Identity, endpoint & patch · ~40 minutes

This playbook converts Defender for Endpoint or Qualys/Tenable-class exports into an effort-aware, business-aware remediation plan: AI does the clustering, deduplication and work-item drafting; you supply the asset context; and anything requiring a call on active exploitation risk goes to security, explicitly, in writing. (UC-35)

When to use

• The scanner backlog exceeds triage capacitythousands of findings, dozens of new CVEs a week, and the team is remediating by scroll order or CVSS alone.
• Findings-to-work-items translationone patch often clears hundreds of findings; AI is excellent at inverting the list from per-CVE to per-action.
• Monthly remediation planning with the security team, where you need a defensible "this order, because" narrative.

When NOT to use

• Active-exploitation callswhether a CVE is being exploited against orgs like yours, and whether to break change freeze for it, is the security team's judgment, informed by threat intel you may not see. AI summarizes; it does not adjudicate.
• Unowned asset inventoryif you cannot say what a server does, business-aware ranking is fiction. Fix (or bound) the inventory first.
• Compliance-driven scan-and-patch contracts where the remediation order is contractually fixed — the plan is already written; AI only helps with the paperwork.

The recipe

1. 1.

   Export with context columns, not just findings. From Defender (Vulnerability management > Weaknesses / Recommendations) or Qualys, export findings joined to: asset name, OS, exposure (internet-facing or internal), asset tag or owner, and the scanner's own severity plus EPSS/exploited-in-wild flags where the platform provides them. The export's context columns determine the plan's quality.

2. 2.

   Add the business-context table AI cannot know. Ten lines you maintain, pasted into every planning prompt: PAYROLL-* — finance-critical, change window Sat only, WEB-DMZ-* — internet-facing, no freeze, LAB-* — isolated, best-effort. This table is your judgment, versioned in the runbook.

3. 3.

   Run the ranking prompt.

   Copy

   Inputs: (a) vulnerability export [paste/attach], (b) business
   context table [paste], (c) constraint: ~2 engineer-days of
   remediation capacity this week.
   
   Produce a remediation plan:
   1. Collapse findings into ACTIONS (one patch/config change that
      clears many findings = one action), with findings-cleared count
   2. Rank actions by: scanner-flagged exploited-in-wild first, then
      internet-facing exposure, then business criticality, then
      findings-cleared per unit of effort
   3. For each action: affected assets, effort estimate (S/M/L),
      change-window constraint from the context table, expected
      findings cleared
   4. A SECURITY-REFERRAL list: any item whose ranking depends on
      exploitability judgment or threat-intel I haven't given you —
      state exactly what question security needs to answer
   5. An explicit NOT-THIS-WEEK line with what is deliberately deferred
   Do not invent exploitation status; use only flags present in (a).
   

4. 4.

   Read the referral list first. A good output routes rather than guesses:

   Copy

   SECURITY-REFERRAL
   - CVE-2026-31118 (OpenSSH, 14 internal servers): scanner shows no
     exploited flag, but public PoC noted. Question for security: does
     internal-only exposure + PoC justify jumping the queue this week?
   - WEB-DMZ-03: EOL framework finding — remediation is an upgrade
     project, not a patch. Needs a risk acceptance or a project ticket.
   

   Send that list to security verbatim, get written answers, and re-rank with them. This routing step is the difference between AI-assisted prioritization and AI-invented threat assessment.

5. 5.

   Spot-check the collapse logic. Pick two actions and verify the findings-cleared math against the scanner: does the KB actually remediate those CVE instances on those OS builds? Superseded-patch chains and per-OS applicability are where the collapse goes wrong.

6. 6.

   Turn the ranked plan into tickets with rollback lines. Have AI draft one work item per action — assets, change window from the context table, verification step ("rescan clears findings X,Y,Z"), rollback note — into your ITSM format. The verification step closes the loop: a remediation ticket without a rescan criterion is patching on faith.

7. 7.

   Re-export after the change window and measure. Findings cleared vs. plan, actions that missed, new arrivals. Feed the misses back: if effort estimates ran hot, say so in next month's prompt; the plan gets more accurate because you graded the last one.

Make it yours

• Defender + Intune shopuse the built-in remediation-request flow between Defender vuln management and Intune for the mechanics, and where the Intune Copilot vulnerability-remediation agent is available, treat its suggested remediations exactly like the plan above: rank-checked by you, exploitability-checked by security, piloted before broad deployment.
• Qualys/Tenable + mixed fleetlean on their EPSS and exploited-in-wild feeds as ranking inputs (they are the legitimate source for the flags in step 3); export via API weekly so the plan is a standing Monday artifact.
• Small shop with no security teamthe referral list still gets written, but it routes to your MSSP, your vCISO, or a documented weekly decision you make and sign. The point is that exploitability calls are logged as judgments, never as model output.

Quality check

• Every ranking factor is traceable to an input. If the plan says "actively exploited", that flag must exist in the export — challenge any ranking rationale you cannot find in your own data.
• The referral list is never empty two months running. An AI plan with no security-judgment questions is not clean — it is overconfident.
• Collapse math is spot-checked per cycle. Two actions, verified against the scanner's own supersedence data.
• Deferred means dated. The NOT-THIS-WEEK list carries a revisit date, or it is a quiet risk acceptance nobody signed.