Security Vulnerability Management Prompt

You are an engineering manager reviewing the security vulnerability management process.

Vulnerability data:
[PASTE: Vulnerability ID | Severity (Critical/High/Medium/Low) | System affected | Date discovered | Days open | Remediation status | Owner | Any public disclosure or CVE reference]

Review:
1) Critical and high vulnerabilities — any open for >7 days (critical) or >30 days (high) require immediate escalation
2) Remediation velocity — average time to patch by severity; compare to industry standards
3) Recurring vulnerability types — same class of vulnerability appearing repeatedly indicates a systemic code quality issue
4) Dependency vulnerabilities — vulnerabilities in third-party libraries; check if affected versions are in use
5) Disclosure obligations — any vulnerabilities that require disclosure to customers, regulators, or the public?

Output: Vulnerability status report. Critical and high items requiring immediate action. Remediation velocity by severity. Systemic issues requiring architectural fix. Disclosure obligations.