For AppSec and engineering
Prioritize vulnerabilities
with production evidence.
Bring observed execution, affected workloads, and available fixes into the same review. Give engineering the context behind the next remediation decision.
Vulnerability Funnel
From inventory to observed execution · evidence levels shown only where the finding supports them · Illustrative vulnerability workflow
Separate inventory from runtime evidence.
An installed package, a loaded library, and an observed function call describe different levels of activity. Review the evidence available for each finding rather than treating every inventory result as equally urgent.
Open the finding behind the number.
Inspect the affected workload and the runtime evidence associated with a vulnerability. Where supported and captured, call-stack context gives developers a more specific place to investigate.
Example finding · Illustrative vulnerability workflow
Make the next patch decision explainable.
Review the affected version, available fix information, and workload history. Combine that evidence with severity, exposure, and your remediation policy to decide what to address next.
Upgrade Newtonsoft.Json: the vulnerable function was observed executing in production. Example fix information.
The vulnerable function Newtonsoft.
Where it ran
Call stack
Example fix information · call-stack excerpt where captured
Keep uncertainty visible.
A workload may not have exercised a vulnerable path during observation. Missing execution evidence is not proof of safety, and execution alone is not proof of exploitation.
Activity Timeline
Every detection, version change and remediation for this workload, in the selected period.
Version History
Every image version this workload has run, and how long each was live.
Finding history and image versions · reference workload
Questions teams ask.
- Can we stop patching vulnerabilities that were not observed?
- No. Use runtime evidence to inform prioritization alongside your existing risk and remediation requirements.
- Does Primod replace inventory scanning?
- Inventory and runtime evidence answer different questions. This workflow uses both to inform a finding review.