Remediation & Patching
Once something risky is in your inventory, decide what to fix first, test the fix safely, and ship a hardened configuration.
How to Use the Patch Priority Leaderboard
Pick the next dependency to upgrade by reading the leaderboard — KEV-pinned and EPSS≥0.5 ranked, with `+N deps unblocked` badges showing each upgrade's transitive cleanup.
How to Run the Patch Simulator
Preview the impact of a candidate upgrade — which CVEs clear, how many transitive dependencies unblock, what other packages might need to move with it — before you open a PR.
How to Generate a Hardening Bundle from the Admin Wizard
Produce a single zip that contains a Kubernetes admission webhook manifest, network egress allowlist, MDM payloads for Jamf/Intune, CI snippets, and a Prometheus bypass alert — wired to your specific deployment, not a generic example.
How to Answer "Are We Affected by CVE-X?" Using the Inventory Dashboard
When a new CVE drops, you have minutes to answer "are we exposed?". Walks through the /inventory dashboard, the chainsaw_query_inventory MCP tool, and the dependsOn-graph search that finds transitive exposure.
Policy keeps new risk off the install path; remediation deals with what is already in your inventory. This section ranks what to patch first by real-world exploit signal, lets you rehearse a patch before rolling it, packages a hardened configuration, and answers the “are we affected by CVE-X?” question every team eventually gets asked. Chainsaw ranks and rehearses; it does not open the upgrade PR — that stays with your existing patch tooling.
Prioritize by exploitability, not raw CVE count. The leaderboard
ranks by KEV and EPSS so you fix the handful of issues attackers are
actually using before chasing low-signal noise.
Where to next
The inventory and SBOMs these guides query come from Provenance & SBOM; roll a hardened config out org-wide from Monitoring & Compliance.