> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/program-management.md). # Security Program Management ## Overview Detecting and fixing vulnerabilities is only useful if the right work happens in the right order, with the right people, at the right time. Security Program Management is the part of Nullify that runs your security program the way a security engineering lead would: it maintains a prioritized backlog across every capability, monitors emerging threats, understands who owns what and how much they have on their plate, and drives work to completion through campaigns — opening PRs, filing tickets, nudging, and escalating. ## Campaigns A **campaign** is how Nullify organizes a body of security work toward an objective — "eliminate leaked secrets," "upgrade the dependencies affected by this CVE," "harden our Terraform." Campaigns are the unit you see and steer in the dashboard and API. ### How a campaign runs 1. **Detect** — Nullify proposes campaigns from your current backlog, threat intelligence, and organizational risk, tailored to what it actually found. There's no fixed catalog of templates to pick from. 2. **Decide** — a security leader adjusts the scope and the level of automation: which findings are in, whether Nullify opens PRs, files tickets, or just notifies, and any deadlines. 3. **Execute** — Nullify assigns work to the right owners, opens fix PRs, creates and updates tickets, and escalates when progress stalls. 4. **Report** — progress is tracked in real time: findings in scope, resolved vs. remaining, time to resolution, per-team progress, and SLA compliance. ### Scoping a campaign Campaigns can target work by finding type (specific CWEs or CVEs), repository, team, individual, severity, or a combination. Campaign targeting currently covers code, dependency, container, secret, and pentest findings. Common campaign themes Nullify generates include eliminating credential leaks, upgrading vulnerable dependencies, hardening Terraform, closing OWASP Top 10 gaps, and meeting compliance requirements (PCI-DSS, HIPAA, SOC 2) — but every campaign is generated to fit what Nullify finds, not chosen from a fixed list. ## The Backlog Nullify maintains a single curated backlog that combines findings from across the platform — code vulnerabilities and leaked secrets from [code review](/capabilities/code-reviews.md), infrastructure misconfigurations from [cloud audits](/capabilities/cloud-audits.md), supply-chain risks from [SCPM](/capabilities/scpm.md), and validated findings from [pentests](/capabilities/pentests.md) and [bug hunts](/capabilities/bug-hunts.md). The backlog is ordered by an overall **priority score** (0–100) that weighs severity, exploitability, reachability, and business impact together — not raw CVSS alone. Resolved findings drop off automatically, and each remaining finding is linked to the PRs and tickets tracking its remediation so status stays current. See [Triage](/capabilities/triage.md) for how findings are scored. ## Threat Intelligence Nullify continuously researches the external threat landscape for risks specific to your stack — actively exploited vulnerabilities and zero-day disclosures affecting the technologies and dependencies you actually run. This intelligence feeds prioritization and escalation: a finding that becomes actively exploited is pushed up, and a serious enough disclosure can trigger a campaign. When a major threat drops, Nullify opens a **threat investigation** — a trackable record of the threat, which of your repositories are affected, and the remediation progress against it. You can list, view, and act on investigations from the dashboard and API. ## Ownership and Capacity Good routing depends on knowing who owns what and who's overloaded. * **Ownership** comes from CODEOWNERS, commit history, service metadata, and connected sources like [Compass](/connectors/compass.md) and your team structure. * **Capacity** is a lighter-weight, qualitative read: Nullify considers how many open PRs and assigned tickets a person already has, and their recent history of merging and closing work, so it can route new work to people who can actually take it on and avoid piling onto someone who's swamped. Nullify respects team boundaries — it won't reassign work across teams without approval. When it can't determine ownership, it raises an [action item](/capabilities/working-with-nullify.md) asking you to assign a team. ## Assigning and driving work When Nullify assigns and sequences work, it weighs the finding's priority (severity, exploitability, reachability, business impact), current ownership, and team capacity. It then drives each item to completion: * Opens [autofix](/capabilities/remediations.md) pull requests and assigns reviewers using the ownership cascade described in Remediations. * Creates and updates tickets in Jira and other trackers. * Monitors open security PRs, comments with context, and escalates the ones that stall. * Tracks each finding's status as its PR or ticket moves. ## Security Program Strategy Beyond day-to-day work, Nullify maintains a rolling **strategy** — a set of quarterly security goals for your program. The strategy is versioned (so you can see how it's evolved), editable, and Nullify can generate a proposed strategy from your current posture and risk profile. It gives the program a direction that individual campaigns ladder up to. ## Ground Rules You set the boundaries Nullify operates within. **Ground rules** are per-action-type controls — you decide which autonomous actions Nullify may take on its own (for example, whether it may open fix PRs, triage automatically, or select reviewers) and which require a human. These are configured under **Configure → Manager** in the dashboard. Nullify operates inside those rules everywhere it acts. ## Metrics & Reporting Track the program's effectiveness with: * **Mean Time to Remediate (MTTR)** — average time from discovery to fix, plus related mean-time variants. * **Finding counts** — backlog totals and trend over time. * **Team velocity** — fixes per sprint or week. * **SLA compliance** — the share of findings fixed within their SLA. * **Campaign progress** — resolved vs. remaining, per team, with burn-down. ## How it connects Security Program Management sits at the center of Nullify: it reads triaged findings and the [Context Engine](/capabilities/context-engine.md), drives [Remediations](/capabilities/remediations.md), routes through your [ticketing](/connectors/jira.md) and [messaging](/connectors/slack.md) connectors, and raises [action items](/capabilities/working-with-nullify.md) when it needs a human decision.