A 30-minute weekly routine has five steps: review new alerts, check whether anything you run is known to be exploited, merge safe dependency updates, record decisions in one list, and stop. Fixed time and fixed steps beat an open-ended "keep an eye on security" intention that never gets calendar space.
Why a fixed routine beats good intentions
Small teams rarely fail at vulnerability management because they lack tools. They fail because the work has no slot. Alerts pile up, the backlog looks hopeless, and the whole thing gets skipped. A weekly block of 30 minutes, same day and time, turns it into maintenance. NIST describes patching as "preventive maintenance for computing technologies" in its patch management guide, and that framing helps: you do not debate whether to service the car every week, you just book it.
The five steps
| Minutes | Step | Output |
|---|---|---|
| 5 | Open the alert list for your repositories and sort by importance | A short list of new items |
| 5 | Check each new item against the CISA Known Exploited Vulnerabilities catalog | A flag for anything exploited in the wild |
| 10 | Review and merge dependency update pull requests that pass tests | Fewer open alerts |
| 5 | For each item you will not fix this week, write one line: reason and revisit date | An honest record |
| 5 | Check that scans and alerts are still switched on for every project | Confidence the inputs work |
The KEV catalog is described by CISA as a list of vulnerabilities known to be exploited in the wild, and CISA says organizations should use it as an input to their prioritization process. It is also published as a CSV and JSON file, so you can check it quickly.
What to put in the "not this week" list
Be specific. "Transitive dependency in a test tool, not reachable from production code, revisit in four weeks" is a decision. "Later" is not. Dependabot lets you dismiss an alert with a reason and an optional comment, which gives you a place to keep that note next to the alert itself.
The stop rule
When the timer ends, stop. If something exploited and exposed turns up, that is an incident-style task and gets its own time. Everything else waits for next week. A routine that regularly runs to two hours will be abandoned within a month.
What to do on the first week
The first session will be longer because of the backlog. Do not try to clear it. Spend the 30 minutes on the newest items and anything on the KEV list, and schedule the older backlog in short slices over the following weeks.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is 30 minutes enough for a team of five?
Usually yes for triage, if one person owns the block and others fix what they are assigned. Fixing itself takes extra time beyond the routine.
What if nothing new shows up?
Use the time to confirm that scanning and alerts are still enabled on every project. Silent breakage of the inputs is a common failure.
If you want a quick outside view, Safeguard offers a free scan at gold.safeguard.sh/scan, and its dependency scanning and reachability analysis can help you decide which findings to read first.
Sources
- CISA Known Exploited Vulnerabilities Catalog
- NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
- GitHub Docs, viewing and updating Dependabot alerts
Last reviewed: 19 October 2026.
