Prioritisation Is the Whole Job

Most security teams have more findings than they can ever close. The problem isn't the volume, it's having a defensible answer for what gets fixed first.

We'll go through how that call actually gets made. Severity scores rank things badly. Reachability and exposure change the order. Forty thousand findings usually comes down to a few dozen that matter, and the rest can wait or be accepted. You'll rank a set of findings yourself during the session and see what happens to that order once context is applied.

Running alongside that, a threat hunting and incident response view of what attackers actually went for. Rarely the things at the top of anyone's list.

Which raises the question of how you'd know. Prioritisation is only as good as the threat context behind it, and generic exploit feeds are too broad to be much use. What shifts the order is knowing what's being used against organisations like yours, in this country, right now — which means somebody has to be watching locally and feeding it back.

But ranking is only the easy half. Getting it fixed means change windows, app owners, vendors, and a lot of chasing, and none of that shows up in a risk score.

You'll see the actual ranking logic, not a description of it.

Who should attend?

Anyone who owns a security backlog or answers for one — security leaders, IT managers, engineers, SOC and vulnerability management teams. Also useful if you're a developer or product lead who gets sent security findings and wonders how they got ranked, or if you're earlier in your career and want to see how these decisions actually get made.

UST will be hosting six events during LDF and will provide food and refreshments, tailored to the timing and format of each event.

Photography will take place at all events. If you do not wish to be photographed, please notify a member of the event staff in advance or upon entering the venue.

Registration Eligibility Notice

This event is intended for a select group of professionals. UST reserves the right to review and confirm all registrations to ensure the best possible experience for attendees.

Description supplied by the event organiser.