Remediation

Remediation is the process of correcting a security finding or control gap: patching a vulnerability, tightening a configuration, or implementing a missing control. In third-party cyber risk management, remediation may occur at the vendor level or through compensating controls at the first-party level. Black Kite supports remediation tracking and vendor collaboration through The Bridge™.

What Is Remediation in Cybersecurity?

Remediation is the work of eliminating a security weakness at its root cause, such as patching a vulnerability, correcting a misconfiguration, or shutting down an exposed service. It follows detection. Once a scan, assessment, or investigation produces a finding, remediation is the corrective action that closes it and returns the affected system to a secure state.

What's the Difference Between Remediation and Mitigation?

Remediation removes a weakness, while mitigation reduces the likelihood or impact of its exploitation without removing it. A risk team has several ways to respond to a known weakness, including:

Remediation, eliminating the weakness itself, such as applying a patch.
Mitigation, lowering the likelihood or impact of exploitation while the weakness remains, such as restricting network access to a vulnerable system.
Risk acceptance, a documented decision to keep a risk that falls within the organization's risk tolerance.

Mitigation Keeps the Finding Open

Mitigation can serve as a bridge to remediation. When a fix isn't available yet, a compensating control limits exposure until it is. Teams should track a mitigated finding separately from a remediated one, because the underlying flaw is still there if the control fails or is changed.

What Does Remediation Look Like When a Vendor Owns the Fix?

When the weakness sits in a vendor's environment, the vendor carries out the remediation, and the customer's role becomes requesting it, tracking it, and verifying it. The customer can't log in and apply the fix. Third-party remediation follows a different sequence:

Share the specific finding and its evidence, so the vendor knows exactly what to fix and where.
Agree on a timeline tied to severity, with critical issues handled first.
Track progress in one place, such as a ticket for each finding.
Verify the fix independently, instead of closing the finding on the vendor's word alone.

Patching is one form this takes, and the details of that process are covered under patch management.

Why Does Remediation Stall Even After a Breach?

Being breached doesn't guarantee that an organization fixes the weaknesses behind the breach. Black Kite's 2026 Ransomware Report compared ransomware victims’ security posture at disclosure with a later rescan. In the latest rescan, 43.5% of victims still carried critical vulnerabilities, and stealer log exposure was 175% higher than at disclosure.

An Incident Notice Is a Reason to Check

For third-party risk teams, a vendor's incident notice is a reason to check its remediation status directly, since the data shows remediation can't be assumed. When remediation follows an incident, it becomes part of the vendor's incident response, and the customer's questions should cover it.

How Do You Verify That a Vendor Remediated?

Verification from outside works for issues that are visible from outside, and fixes to internal systems or policies need documentary evidence. An exposed service that's been shut down or a vulnerable version that's been upgraded can be confirmed by observing the vendor's internet-facing assets again. ### Some Fixes Need Documents Instead of Scans

A fix to an internal server, an access control, or a policy can't be observed that way. For those, useful evidence includes configuration records, updated policy documents, and results from an independent test. Matching the evidence type to the fix keeps a finding from closing on the vendor's word alone.

How Is Remediation Applied in Third-Party Risk Programs?

In a third-party program, remediation depends on getting the right evidence to the vendor and keeping a record of what happened next. Black Kite approaches third party risk remediation through The Bridge™, a free, curated portal where vendors receive asset-level vulnerability intelligence and real-time ratings updates, with an auditable history of communications, actions taken, and remediation progress. Continuous monitoring then shows when a vendor's risk profile changes. Remediation also sits inside a broader vendor risk response process, and the TPCRM knowledge center collects Black Kite's related resources.