Responding to a critical CVE is part patching and part proving that nothing important broke.

What this note will cover

  • Scoping which applications are affected
  • Patching and the regression checks that follow
  • Building an evidence pack a reviewer can follow
  • Keeping report-only evidence clearly labelled as such

Why it matters

Evidence turns a patch into a decision a business can rely on.