> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/program-management.md). # Security Program Management > **Maturity: GA** — Defined in the production stack configuration (`iac/stacks/prod/module-manager.tf`); campaigns, action items and SLAs are first-class stored objects. ## Overview Detecting and fixing vulnerabilities is only useful if the right work happens in the right order, with the right people, at the right time. Security Program Management is the part of Nullify that runs your security program the way a security engineering lead would: it maintains a prioritized backlog across every capability, monitors emerging threats, understands who owns what and how much they have on their plate, and drives work to completion through campaigns — opening PRs, filing tickets, nudging, and escalating. ## Campaigns A **campaign** is how Nullify organizes a body of security work toward an objective — "eliminate leaked secrets," "upgrade the dependencies affected by this CVE," "harden our Terraform." Campaigns are the unit you see and steer in the dashboard and API. ### How a campaign runs 1. **Detect** — Nullify proposes campaigns from your current backlog, threat intelligence, and organizational risk, tailored to what it actually found. There's no fixed catalog of templates to pick from. 2. **Decide** — a security leader adjusts the scope and the level of automation: which findings are in, whether Nullify opens PRs, files tickets, or just notifies, and any deadlines. 3. **Execute** — Nullify assigns work to the right owners, opens fix PRs, creates and updates tickets, and escalates when progress stalls. 4. **Report** — progress is tracked in real time: findings in scope, resolved vs. remaining, time to resolution, per-team progress, and SLA compliance. ### Scoping a campaign Campaigns can target work by finding type (specific CWEs or CVEs), repository, team, individual, severity, or a combination. Campaign targeting currently covers code, dependency, container, secret, and pentest findings. Common campaign themes Nullify generates include eliminating credential leaks, upgrading vulnerable dependencies, hardening Terraform, closing OWASP Top 10 gaps, and meeting compliance requirements (PCI-DSS, HIPAA, SOC 2) — but every campaign is generated to fit what Nullify finds, not chosen from a fixed list. ## The Backlog Nullify maintains a single curated backlog that combines findings from across the platform — code vulnerabilities and leaked secrets from [code review](/capabilities/code-reviews.md), infrastructure misconfigurations from [cloud audits](/capabilities/cloud-audits.md), supply-chain risks from [SCPM](/capabilities/scpm.md), and validated findings from [pentests](/capabilities/pentests.md) and [bug hunts](/capabilities/bug-hunts.md). The backlog is ordered by an overall **priority score** (0–100) that weighs severity, exploitability, reachability, and business impact together — not raw CVSS alone. Resolved findings drop off automatically, and each remaining finding is linked to the PRs and tickets tracking its remediation so status stays current. See [Triage](/capabilities/triage.md) for how findings are scored. ## Threat Intelligence Nullify researches newly disclosed vulnerabilities and supply-chain compromises for all customers and assesses each one against your environment as a **threat investigation**. A confirmed exposure to a critical, known-exploited vulnerability with a fixed release opens a remediation campaign. See [Threat Intelligence](/capabilities/threat-intelligence.md). ## Ownership and Capacity Good routing depends on knowing who owns what and who's overloaded. * **Ownership** comes from CODEOWNERS, commit history, service metadata, and connected sources like [Compass](/connectors/compass.md) and your team structure. * **Capacity** is a lighter-weight, qualitative read: Nullify considers how many open PRs and assigned tickets a person already has, and their recent history of merging and closing work, so it can route new work to people who can actually take it on and avoid piling onto someone who's swamped. Nullify respects team boundaries — it won't reassign work across teams without approval. When it can't determine ownership, it raises an [action item](/capabilities/working-with-nullify.md) asking you to assign a team. ## Assigning and driving work When Nullify assigns and sequences work, it weighs the finding's priority (severity, exploitability, reachability, business impact), current ownership, and team capacity. It then drives each item to completion: * Opens [autofix](/capabilities/remediations.md) pull requests and assigns reviewers using the ownership cascade described in Remediations. * Creates and updates tickets in Jira and other trackers. * Monitors open security PRs, comments with context, and escalates the ones that stall. * Tracks each finding's status as its PR or ticket moves. ## Security Program Strategy Beyond day-to-day work, Nullify maintains a rolling **strategy** — a set of quarterly security goals for your program. The strategy is versioned (so you can see how it's evolved), editable, and Nullify can generate a proposed strategy from your current posture and risk profile. It gives the program a direction that individual campaigns ladder up to. ## Ground Rules You set Manager’s action boundaries with program autonomy policy, tenant and team ground rules, and blocked action types. Controls cover PRs, tickets, messages, and reviewer selection; they do not disable upstream triage. See [Manager Configuration](/configuration/configuration-manager.md) for the distinct controls and API paths, including settings absent from the current dashboard. ## Metrics & Reporting Track the program's current state with: * **Mean Time to Remediate (MTTR)** — average time from discovery to fix, plus related mean-time variants. * **Finding counts** — current backlog totals. * **Campaign progress** — resolved vs. remaining, per team. Metrics reflect the latest run; Nullify does not retain a historical time series, so there are no trend, velocity, or burn-down charts. ## How it connects Security Program Management sits at the center of Nullify: it reads triaged findings and the [Context Engine](/capabilities/context-engine.md), drives [Remediations](/capabilities/remediations.md), routes through your [ticketing](/connectors/jira.md) and [messaging](/connectors/slack.md) connectors, and raises [action items](/capabilities/working-with-nullify.md) when it needs a human decision. ## Automation API The [Manager API](/api-reference/api-reference/manager.md) covers campaigns and run history, strategies and versions, proposals and decisions, action items, plans, state, metrics, chat audit, and escalation configuration. Strategy and campaign proposals arrive as named action items; use their decision workflow to approve or reject them.