How do you document CVEs that aren’t exploitable in your environment?
I'm the only security and platform person at a small fintech preparing for SOC 2. Patching vulnerabilities with available fixes is manageable, but scanners keep flagging issues where…