Vulnerability Management

This page covers how CTO2B identifies, prioritises, and remediates
vulnerabilities across the platform and infrastructure we manage on your
behalf, and which parts remain yours.

Shared responsibility model

Party	Responsible for
Cloud provider (security of the cloud)	Physical security, underlying hardware, and managed-service baseline security; provides the maintenance and patching mechanisms for managed services
CTO2B (security in the cloud, for platform and infrastructure)	Secure configuration, identity and access management, network controls, patch coordination, and infrastructure remediation
Your team (application code)	Application code security, dependency management, secure build and release practices, and remediation of application-level vulnerabilities

Each cloud provider publishes its own shared responsibility model:

CTO2B is responsible for the secure operation and maintenance of
infrastructure and platform services: configuration hardening, access
control, network segmentation, patch coordination, and executing remediation
through controlled change management with audit evidence.

CTO2B does not operate as a Security Operations Center. There is no 24x7
dedicated threat-hunting or security incident response function — see
Security Monitoring and Threat Detection
for the exact boundary.

Asset inventory

In-scope assets are tracked using configuration management and
version-controlled definitions. This covers cloud accounts and projects and
their regions, network boundaries, compute (virtual machines, node pools,
autoscaling groups), Kubernetes platform components, managed databases,
object storage, load balancing and ingress, and container registries.

How vulnerabilities are identified

Container image and artifact scanning — images and relevant artifacts
are scanned continuously by the registry or build pipeline as they are
pushed and stored, and findings are reviewed as part of operational change
planning.
Cloud provider advisories and maintenance guidance — CTO2B monitors
relevant provider advisories and managed-service maintenance notifications
to plan updates for affected components.
Configuration and change-driven reviews — infrastructure changes go
through peer review and a controlled Infrastructure as Code change process,
which surfaces misconfigurations and security gaps during change cycles.

Prioritisation

Findings are triaged using risk-based criteria:

Severity (Critical, High, Medium, Low), typically aligned with CVSS
where available
Exposure (internet-facing versus internal), blast radius, and privilege
level
Exploitability, including whether active exploitation is reported in
vendor advisories
Business criticality, prioritising production systems

There is no fixed patch SLA. Remediation is handled in a timely, risk-based
manner, prioritising Critical and High findings.

Remediation and patching

Compute and OS patching — virtual machines and worker nodes are patched
through maintenance windows or rolling updates where supported, to minimise
service disruption. Managed Kubernetes worker nodes are typically updated
via node image updates and controlled rollouts.
Managed services patching — coordinated using the cloud provider's own
maintenance mechanisms, such as managed database engine patching and
managed Kubernetes control plane updates, aligned with your environment's
risk and availability needs.
Workload and image remediation support — where applicable, CTO2B
coordinates rebuild and redeploy activities with your team, applies
platform-level mitigations such as configuration hardening and network
restrictions, and ensures secrets are handled through secure secret
management rather than embedded in code or images.

Remediation of application source code and third-party library
vulnerabilities is owned by your team through your own development lifecycle.

Verification and evidence

Evidence maintained to support auditability includes change records for
remediation activities, version control history for infrastructure
definitions, and cloud audit and platform logs for administrative actions and
change traceability.