The constraint
An audit window opened with a backlog the team had written off as unclearable. Everything was ranked by CVSS score, which meant genuinely exploitable issues sat below theoretical ones in unreachable code paths.
What we changed
We re-triaged the backlog by reachability — whether an attacker could actually get to the code — and shipped in waves, each behind its own regression suite.
- Reachability analysis before severity ranking
- Phased waves with independent rollback
- Policy-as-code so the same class could not reappear
Where it landed
Ninety-five percent of critical findings closed inside the quarter, with no production regressions attributable to the remediation work.
