# Vulnerabilities: prioritize the affected-system decision

https://thiago.limaesilvatecnologia.com.br/en/artigos/vulnerability-priority/

Published: 2026-09-12

Component severity is an input, not the whole context.

Content produced with AI assistance for Thiago Silva’s website. Independent editorial analysis; it does not represent clients or employers.

Reading-path month: September 2026

Collection published on September 12, 2026. Months organize the reading path; they are not earlier publication dates.

A short architecture article. The technical reference supports the topic; hypothetical scenarios and assessment proposals are editorial analysis, not accounts of personal implementations.

## The architecture decision

A findings queue does not explain exposed product paths. Combine the issue with deployment, usage and risk-reduction options.

## Practical application

Editorial proposal: document one finding's component, running version, reach and owner. In a hypothetical service, distinguish permanent fixes from temporary measures with separate deadlines and evidence.

## How to verify

After changes, verify both updating and affected functionality. Record reasons and review dates for deferral. Build traceable decisions rather than permanent, ownerless risk-acceptance states.

## Sources

- [OWASP — Vulnerable Dependency Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Vulnerable_Dependency_Management_Cheat_Sheet.html). Accessed: 2026-09-12.

[Profile: Thiago Silva | Cyber Architect](https://thiago.limaesilvatecnologia.com.br/en/perfil/)