# Turn a vulnerability scan into a prioritized fix plan

Ranks scanner findings by real-world risk, not just CVSS, and groups them into a remediation plan with owners and deadlines.

- Topic: Projects & Operations
- Framework: Few-Shot
- Level: Standard
- Tags: Productivity, Plan, Brainstorm, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/turn-a-vulnerability-scan-into-a-prioritized-fix-plan

## Prompt

```text
Help me turn vulnerability scan results into a prioritized remediation plan.

**Scan export:** [PASTE findings: CVE or plugin, CVSS, host, OS or software, first seen]
**Asset context:** [which hosts are internet-facing, hold sensitive data, or are business-critical]
**Known exploited or EPSS data:** [PASTE if I have it - otherwise "none"]
**Compensating controls:** [e.g. "behind VPN", "EDR on all endpoints", "WAF in front of web apps"]
**Our remediation SLAs:** [e.g. "critical 7 days, high 30 days" - or "suggest some"]
**Team capacity:** [people and hours per week available]

Prioritize using these factors, in order: actively exploited in the wild (if I provided that data), exposure (internet-facing first), asset criticality, exploit complexity, then CVSS. Explain any case where you rank something above a higher CVSS score.

Then:
1. Group findings that one fix resolves (a single patch, upgrade, or config change across many hosts).
2. Flag likely false positives or findings that need verification (e.g. backported patches).
3. Identify items that cannot be patched soon and suggest compensating controls or a documented risk acceptance.

Return:
- A remediation table: Priority | Fix action | Findings covered | Hosts | Owner [ADD] | Due date | Notes.
- The top 5 actions for this week.
- A 3-sentence summary for my manager.

Do not invent exploit status or CVE details I did not provide; mark them [VERIFY].
```

## What to fill in

- PASTE if I have it - otherwise "none"
- e.g. "critical 7 days, high 30 days" - or "suggest some"
- people and hours per week available
- ADD

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.