vulnerability management

Three words people use interchangeably, and a prioritisation question that exposes whether you have ever had a backlog of thirty findings.

Severity disputes are usually disagreements about facts or assumptions. The scored answer finds which, settles it with evidence and the agreed scale, and has an escalation path that does not damage trust.

When finding a bug costs a few dollars of compute, the defender's advantage has to come from somewhere else. A staff-level answer says exactly where.

A patch is a map to the bug it fixes. The interview question is what that means for disclosure timing, open-source fixes and your own patch deadlines.

GPU nodes carry layers most patch programmes forget: drivers, firmware, CUDA libraries and container toolkits. The scored answer inventories them, prioritises by exposure, and patches without breaking month-long training runs.

Sorting by CVSS score sends teams after thousands of 'criticals' nobody will ever exploit. The answer weighs whether exploitation is happening, whether the asset is reachable, and what it would cost you.

Deciding what to fix is half the job. The other half is getting a fix onto 20,000 machines without breaking them, and proving it landed. Few candidates can describe that half.

A dashboard shows improvement while authenticated assessment coverage shrinks. Reconcile inventory, collection and repair evidence before reporting risk reduction.

Rate the supported consequence and conditions, explain retry assumptions and separate severity from deployment risk and response priority.