Keep weekly triage to 30 minutes with a fixed agenda: new exploited issues first, then new high priority findings, then aging items. Rotate the chair, decide on each item in under three minutes, and end every item with an owner and a date. Anything that needs deeper work leaves the meeting as a task.
Prepare before the meeting
Triage fails when people read findings for the first time in the room. The chair spends fifteen minutes beforehand to:
- Pull findings new since last week.
- Check which appear in CISA's KEV catalog, the list of vulnerabilities known to be exploited in the wild.
- Note reachability and exposure for the top items.
- Mark items already assigned, so they are skipped.
The agenda
| Minutes | Item | Output |
|---|---|---|
| 0 to 5 | Anything exploited or newly published and urgent | Owner and same week action |
| 5 to 15 | New high priority findings | Fix, mitigate, accept or dispute, with an owner |
| 15 to 22 | Items near their deadline | Unblock or re-plan |
| 22 to 27 | Disputes and exceptions | Decision or escalation |
| 27 to 30 | Review last week's actions | Close or carry over |
Stop on time. Unfinished items roll to async comments, not to a longer meeting.
The four decisions
Every item gets one of four outcomes:
- Fix: assign an owner and a date.
- Mitigate: apply a control now, with a date to fix properly.
- Accept: record owner, reason and expiry.
- Dispute: the owner challenges the finding, with evidence, and it is re-checked.
If the group keeps discussing without choosing, the item is missing information. Assign someone to find it and move on.
Who attends
A security representative, a representative from each team with items on the list, and the chair. Not everyone needs to attend every week. Teams with nothing new can read the notes.
Keep notes short
One line per item: decision, owner, date. Post them in the team channel the same day. Use the notes to calculate how many items are decided on the first look, a good signal of whether preparation is working.
Retire the meeting when it is no longer needed
If automated routing and policies handle most items, shrink triage to exceptions only. A meeting that exists out of habit costs more than it returns.
Try it yourself
Click through it at your own pace, or open it full screen. Try sorting findings the way you would for the first five minutes of triage.
Safeguard's vulnerability management and zero-day discovery can supply the prepared list. The free scan is a way to see a sample.
Quick check
Who should chair triage?
Rotate among engineers and security. Rotation spreads context and stops the meeting being seen as security's meeting.
What if the list is too long for 30 minutes?
Filter harder before the meeting. Tighten the threshold for what reaches the room, and route the rest through automated rules.
Sources
Last reviewed: 19 October 2026.
