A shared sheet is enough when you have a handful of applications, one or two scanners, and one person doing triage. It stops working when findings arrive faster than someone can merge them by hand, ownership gets unclear, or leadership needs a live view. Those are the signals to automate.
What ASPM does that a sheet can copy
At its core, ASPM merges findings, deduplicates them, links them to an application and owner, and ranks them. Each of those steps can be done by hand for a small estate.
A sheet that works
Create one row per unique finding, defined as a CVE plus a component version in an application. Use these columns:
- Application.
- Owner team.
- Component and version.
- CVE or advisory ID.
- Source tool.
- First seen and last seen dates.
- KEV listed (yes or no). From the CISA catalog.
- EPSS value. From FIRST, which publishes it daily.
- Reachable (yes, no, unknown).
- Priority tier. Calculated from your rules.
- Ticket link.
- Status and date closed.
Add a second tab for exceptions with approver, reason and expiry. A third tab can hold the application list with owners.
A weekly routine
- Import the latest exports from each scanner.
- Remove duplicates by CVE and component version.
- Refresh KEV and EPSS columns.
- Recompute priority.
- Create tickets for new top tier items.
- Mark items closed only after a rescan confirms.
Thirty to sixty minutes a week is realistic for a small estate.
When the sheet breaks
| Sign | What it means |
|---|---|
| The weekly routine takes more than a few hours | Volume exceeds manual capacity |
| Two people edit and overwrite each other | Needs concurrency and history |
| Owners are unknown for many rows | Needs an application catalog |
| You want alerts when a new KEV entry hits you | Needs automation |
| Several tools with different formats | Normalization is eating your time |
| Auditors ask for a change history | Sheets rarely keep a trustworthy one |
Two or three of these together is a sound reason to evaluate ASPM.
What to carry over
When you move, bring your column definitions and rules with you. The rules are the valuable part. A tool configured with unclear rules will only reproduce the confusion faster. Test candidates by loading your last two months of findings and checking whether the output matches what you would have decided.
Honest limits of the sheet
It does not alert, it does not scale, and it relies on discipline. It also makes the logic visible, which is useful when you are still learning what your program needs. Many teams learn more from a month with a sheet than from a vendor demo.
The OWASP guidance on vulnerable and outdated components stresses a patch management process and regular scanning. Both hold whether you track findings in a sheet or a platform.
A worked example
A team of 15 has 20 applications and two scanners. One person spends about 45 minutes each Monday on the sheet.
- Import. Two exports are pasted into a tab. The CVE and component version are combined into a key column.
- Deduplicate. A formula flags repeated keys. 14 duplicates are removed.
- Enrich. KEV and EPSS values are pasted from the public sources. Reachability is copied from the scanner export where present.
- Rank. A formula assigns tiers based on the rules in the policy.
- Route. Tier one and two rows get ticket links.
- Review. The team meets for 15 minutes to look at the top ten and the items past deadline.
The process is cheap, visible and teaches the team what matters. After six months, the team adds a third scanner and a new product line. The Monday task now takes three hours. That is the moment to evaluate automation, and the team already knows its rules.
Step by step: build the sheet in an afternoon
- Create the tabs: Findings, Exceptions, Applications.
- Fill the Applications tab with owner, exposure and criticality.
- Paste in one scanner export and shape it to the columns.
- Add the KEV and EPSS columns and fill them.
- Write the tier formula as a visible rule.
- Add a ticket link column and fill it for tier one and two.
- Create a summary tab with counts by tier, age buckets and owners.
- Set a recurring calendar slot for the weekly routine.
Sheet hygiene rules
| Rule | Reason |
|---|---|
| One row per unique finding | Keeps counts honest |
| Never delete rows, mark closed | Preserves history |
| Record who changed priority and why | Gives auditability |
| Lock the formula cells | Prevents accidental edits |
| Export a dated copy monthly | Gives a history even if the sheet is damaged |
What to test in any ASPM trial
When you do evaluate automation, feed it your last two months of exports and compare its output with your sheet. It should deduplicate at least as well, route to the same owners and rank similarly or better. If it cannot match your own manual process on your own data, it is not ready for your team.
What the sheet teaches you
Running the routine by hand reveals which fields are missing, which sources are noisy and which rules are too blunt. Those lessons transfer directly into any tool configuration. Teams that skip this step often buy a tool and then discover they never agreed on what a priority is.
Try it yourself
Toggle reachability on and see how the ranked list shrinks.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard provides dependency scanning with reachability analysis, so a sheet can start from better data. A free scan is at gold.safeguard.sh/scan.
Quick check
What is the unit for one row?
A unique pair of vulnerability and component version within one application.
What is the clearest sign to move off a sheet?
The weekly merge takes longer than the fixing, or owners and history become unreliable.
Can the sheet satisfy a reviewer asking for evidence?
Yes, if it keeps history, records approvers and exceptions, and you can export dated copies. Reviewers care about the trail, not the tool.
Sources
- CISA Known Exploited Vulnerabilities Catalog
- FIRST, EPSS
- OWASP Top 10:2021, A06 Vulnerable and Outdated Components
Last reviewed: 19 October 2026.
