Work

Turn a list of CVEs into a single ranked queue that reflects exploitability, not just severity.

Problem

CVSS base score alone over-flags. A queue sorted by it buries the few findings that are actually being exploited under thousands of high-but-quiet ones.

Approach

A small Python library that pulls CVSS from the NVD feed, exploit-prediction scores from the FIRST EPSS API, and known-exploited status from the CISA KEV catalog, then blends them into one transparent priority score with tunable weights.

Result

A CSV or notebook in, a ranked action list out — with the reasoning for each rank shown, so a remediation team can defend the order to system owners.

Stack: Python · pandas · requests · NVD API · FIRST EPSS · CISA KEV · Jupyter

Raw scanner exports in; MTTR, aging, and SLA-breach dashboards out.

Problem

Scanner consoles answer 'what is vulnerable' but not 'are we keeping up'. Leadership needs trend lines — mean time to remediate, backlog age, SLA breaches — and those live across exports nobody has time to reconcile by hand.

Approach

A reproducible pipeline: generate synthetic Nessus- and Invicti-style exports, normalize them into a single findings table, compute program metrics, and render a Streamlit dashboard with drill-down by severity, asset class, and age bucket.

Result

One command refreshes the whole view. The synthetic generator doubles as a portable test fixture for anyone building similar reporting.

Stack: Python · pandas · Streamlit · Plotly · synthetic data generator

A calibrated estimate of how long a finding will take to close — and an honest account of where the model breaks.

Problem

Planning remediation capacity means guessing which findings will drag. Severity is a weak proxy: some criticals are a one-line patch, some mediums need a vendor and a change window.

Approach

Supervised learning on a synthetic findings dataset — gradient-boosted trees and logistic regression — predicting whether a finding closes within its SLA. Full treatment of class imbalance, probability calibration, and feature leakage.

Result

A model card that states accuracy, calibration, and the conditions under which the estimate should not be trusted — the part most write-ups skip.

Stack: Python · scikit-learn · pandas · matplotlib · model card

A GitHub Actions workflow that runs SAST, secret scanning, and dependency review against a deliberately vulnerable app — and reports like a human would.

Problem

Shift-left tooling is easy to switch on and easy to ignore. The output is noisy, ungrouped, and lands as a wall of annotations no one reads.

Approach

A reusable workflow wiring CodeQL (or Semgrep), secret scanning, and dependency review over a known-vulnerable sample application, plus a step that collapses the findings into a short ranked digest posted to the PR.

Result

A drop-in workflow other repos can call, and a worked example of tuning the signal-to-noise ratio so developers act on it.

Stack: GitHub Actions · CodeQL · Semgrep · Dependabot · TypeScript · OWASP-style sample app