Eight questions to measure vulnerability remediation "pain"

This blog analyzes why some vulnerabilities are especially “painful” for defenders—beyond severity and prevalence—highlighting the operational challenges of assessment, exploitability determination, testing, and remediation at scale. It outlines eight key questions to gauge response difficulty (time to respond, dependency impact clarity, version and exploitability checks, breakage risk, ease of patching, long-term fix robustness, and direct costs) and recommends vendor practices such as pre-announcing issues with CVEs, clarifying dependency-rooted impacts, simplifying version/config detection, providing safe workarounds, enabling automated patching, and delivering root-cause fixes with backports when warranted, illustrated with examples like OpenSSL, cURL, Log4j, CVE-2023-4863 (WebP), CVE-2023-38408 (OpenSSH), CVE-2023-2868 (Barracuda ESG), and VMware vCenter.