Security playbook · AI Employee: Sig

Vulnerability Assessment & Impact

Security engineers get impact analysis in minutes

Install this playbookBack to marketplace
The problem

When a new CVE drops (Log4Shell, MOVEit, Snowflake, whatever), the security team has 24-48 hours to answer three questions: (1) do we use the affected software, (2) how many systems, (3) what's the exposure. Manual answer means someone greps through inventory spreadsheets, asks every team, waits for responses, misses at least two systems. By the time the answer is complete, the vulnerability is being exploited in the wild.

At a glance
Trigger
Chat
Approvals
None
What it does
Read-only
Systems
Wiz · Snyk · CMDB
How it feels in production

An hour-by-hour walkthrough.

New CVE CVE-2026-4211 published: RCE in library XYZ 2.x, actively exploited. Sig picks up the CVE within 15 minutes of publication and starts impact assessment: Discovery (parallel across sources): - Software Bill of Materials (SBOM) across every production service - Package manifests (package.json, requirements.txt, go.mod, Gemfile.lock) - Container images in registry + running in production - Vendor SaaS with library-XYZ dependency (from public disclosures + our vendor list) - Endpoint software from MDM inventory Results in 30 minutes: - Direct dependency: 14 services, 3 owning teams (payments, auth, notifications) - Transitive dependency: 47 services via vendored deps - Container images: 89 tagged images have vulnerable library - SaaS vendors: 2 vendors (Acme Analytics, Beta CDN) affected per their disclosures - Endpoint: none directly, but 340 developer laptops have library in their dev environments Sig scores each based on internet-exposure + data-sensitivity + patch-availability: - 8 systems: critical (internet-exposed, sensitive data, patch available) → immediate patch - 23 systems: high (internal, sensitive data) → 7-day SLA - Remainder: medium / low For each, Sig files remediation tickets to owning teams + drafts patch PRs where dependencies are straightforward. CISO gets the impact assessment + remediation roadmap within 45 minutes of CVE publication — before the exploit-in-the-wild pattern has spread meaningfully.
How it works

Step by step.

  1. 01

    Monitor CVE feeds + detect new relevant CVEs

    NVD, GitHub security advisories, vendor feeds, exploit trackers. Filter for CVSS + software matching our SBOM.

    NVD · GHSA · Vendor advisories · Exploit trackers
  2. 02

    Impact discovery across every source

    SBOM search, package manifest search, container registry, vendor list, endpoint inventory. Parallel + comprehensive.

    SBOM · Container registry · Vendor list · MDM
  3. 03

    Score exposure per system

    Internet-exposure + data-sensitivity + patch-availability + exploitation-observed. Multi-factor score drives SLA.

    Exposure model · Data classification · CVE data
  4. 04

    Draft remediation with team assignments

    Patch PRs where straightforward. Tickets to owning teams for complex remediation. SLA per severity tier.

    GitHub · Ticketing · Owning team registry
  5. 05

    CISO impact assessment + tracking

    Full assessment within an hour: what's exposed, remediation plan, SLA. Tracking dashboard through remediation completion.

    CISO dashboard · Remediation tracker
Systems and wiring

What you connect to make this run.

SBOM (CycloneDX · SPDX · syft)

read

Comprehensive software inventory. Every production service's dependency tree.

Container registries · Kubernetes

read

Container images + running instances. Vulnerable images identified in registry + deployed state.

GitHub · GitLab · Package registries

read+write

Source code search for direct + transitive dependencies. Patch PRs opened for straightforward upgrades.

Vendor list · SaaS registry

read

Third-party dependencies. Vendor disclosures cross-referenced with our vendor list.

What changes

Before and after, honestly.

Time from CVE publication to full impact assessment
Before
1-5 days
After
Under 1 hour
% of affected systems identified accurately
Before
60-80%
After
98%+
Time from CVE to patched (critical)
Before
3-14 days
After
Under 8 hours
Missed systems discovered post-remediation
Before
5-15%
After
Under 1%
Related

Playbooks that pair with this one.

Security

Vulnerability Remediation Requests

Impact assessment feeds the remediation queue.

Security

Incident Response Orchestration

Actively-exploited CVEs promote to IR.

Security

Vendor Security Review

Vendor CVE impact coordinated with vendor security review.

Frequently asked

Answers about this playbook.

What if SBOM coverage is incomplete?

Best-effort with known coverage explicitly stated. Gaps flagged for SBOM improvement; assessment includes 'coverage %' so consumers know confidence level.

How does it handle vulnerabilities in binaries (not source dependencies)?

Binary analysis + package-manager metadata. Windows patches, macOS software updates, Docker base images all included.

What about zero-day vulnerabilities (no patch available)?

Compensating controls surfaced: WAF rules, feature flags, isolation. Patch availability tracked; alert when patch drops.

How does it coordinate with our red team?

Red team can request impact assessment as part of exercises. Same mechanism; scoped to red-team scenarios rather than public CVEs.

Can it work for internal / custom vulnerabilities?

Yes — internal vuln IDs supported alongside CVEs. Same impact assessment + remediation flow.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore Security playbooks