Your vulnerability remediation SLA starts a clock on every alert. On Redash, an open-source dashboarding tool we'll use as an example, that is 272 clocks. But only about 10% of them need action.

On August 25 our weekly triage deferred a Starlette alert with a 2% EPSS score. On September 1 the same alert, same code, same 2% score, was the only advisory in a 127-alert backlog that had to be fixed that day. Nothing about the vulnerability changed in that week....

“Why not just prompt Claude Code or Copilot to triage dependency alerts per our security policy?” is the right question. A coding agent can read your code, trace a call path, and reason about whether a vulnerable function is reachable. That is the hardest part of alert...