Security Vulnerability
A discovered security weakness — CVE, severity, affected systems, and remediation status.
Why This Object Matters for AI
AI vulnerability detection and prioritization require vulnerability data; security posture depends on tracking vulnerabilities.
Security & Compliance Capacity Profile
Typical CMC levels for security & compliance in SaaS/Technology organizations.
CMC Dimension Scenarios
What each CMC level looks like specifically for Security Vulnerability. Baseline level is highlighted.
Security vulnerability knowledge lives entirely in engineers' heads — someone remembers a CVE was mentioned in a Slack thread last month, but there's no documented process for tracking, triaging, or remediating vulnerabilities.
None — AI has no vulnerability process definitions to follow or enforce.
Document a basic vulnerability management process defining severity classification criteria, triage responsibilities, and remediation SLA expectations.
A general vulnerability management document exists describing severity ratings and remediation expectations, but actual triage depends on who notices the CVE — 'We have a policy, but critical vulns still sit for weeks because nobody enforces the timeline.'
Can reference the policy document but cannot determine whether vulnerabilities are actually following the defined triage and remediation process.
Define structured workflow stages (discovery, triage, assignment, remediation, verification, closure) with mandatory transitions and required fields at each gate.
Workflow stages for security vulnerabilities are defined with mandatory transitions — discovery through closure — but CVSS-to-SLA mappings, exception approval criteria, and risk acceptance documentation requirements are not formalized.
Can track security vulnerabilities through workflow stages but cannot enforce SLA compliance based on CVSS severity or manage exception approvals programmatically.
Formalize CVSS-to-SLA mappings per severity tier, exception approval workflows with risk acceptance documentation, and mandatory verification requirements before closure.
The vulnerability process defines CVSS-to-SLA mappings, exception approval chains, risk acceptance documentation standards, verification requirements, and knowledge base updates that capture remediation patterns for recurring vulnerability classes.
Can enforce SLA compliance by CVSS score, route exception approvals, track risk acceptances, and flag vulnerabilities requiring verification before closure.
Encode vulnerability management rules in machine-readable policy language with automated stage transitions, SLA enforcement, and exception routing logic.
Machine-readable policy rules automate security vulnerability lifecycle transitions — CVSS-driven SLA enforcement, automated assignment based on affected component ownership, exception routing with audit trails, and mandatory verification gates.
Can autonomously orchestrate the vulnerability lifecycle — automated triage by CVSS and asset criticality, intelligent assignment, SLA enforcement, and verification coordination.
Deploy adaptive vulnerability process logic that adjusts triage priority based on threat intelligence feeds, exploit availability, and asset exposure context in real time.
Adaptive vulnerability process logic adjusts in real time — triage priority recalculates when exploit code appears in the wild, SLA targets tighten for internet-facing assets, and remediation patterns auto-generate playbooks from historical resolution successes.
Can autonomously manage the full security vulnerability lifecycle — discovery, prioritization, assignment, remediation orchestration, and verification — adapting to real-time threat context.
Ceiling of the CMC framework for this dimension.
Capabilities That Depend on Security Vulnerability
Other Objects in Security & Compliance
Related business objects in the same function area.
Security Event
EntityA logged security occurrence — type, source, target, and risk level that enables threat detection.
Access Policy
RuleA permission configuration — roles, resources, conditions, and enforcement that controls access.
Compliance Control
EntityA required security measure — framework, control ID, implementation status, and evidence.
User Identity
EntityAn authenticated user record — credentials, roles, last access, and risk indicators.
What Can Your Organization Deploy?
Enter your context profile or request an assessment to see which capabilities your infrastructure supports.