Tuning

The first hour with a list of nine thousand findings

The first scan of a real estate always comes back with more than anybody can work through. That number is not the problem; treating all of it as equally real is. An hour of tuning is the difference between a list people work and a list people close.

What to do

Sort by verified credentials first. There are usually very few and they are the only things on the list that somebody could be using right now.
Then look at anything on the exploited list. A medium that is being exploited in the wild outranks a critical nobody has ever used.
Set a baseline if the backlog is historic. Everything behind the line is still counted and one click away; the work list becomes what has arrived since.
Filter dependencies to reachable only. On most estates that removes three quarters of them, each with a sentence saying why.
Look at the top ten rules by count and decide, once, what each of them is worth. That is usually half of everything on the list.
Accept the recommended grades where they look right. Each is derived from evidence already on the finding, and accepting one is a click that lands in the audit log.

A tip

Do this once, properly, with somebody who knows the estate in the room. Doing it a finding at a time over three months produces a list nobody trusts and a lot of exceptions with no reason written on them.