Before
Security or vulnerability teams likely had to review sent notifications one by one, search the shared mailbox for replies, and determine which unanswered threads had reached the next follow-up threshold. They also had to write the reminder, identify the owner’s managers, copy the correct people, and record which stage had already been sent.
How it works
- Every morning, scan recent vulnerability notifications and match incoming messages to the original conversation, excluding automated replies and already completed threads.
- Determine the highest unanswered follow-up stage reached—J+3, J+6, or J+14—and retrieve the appropriate management contacts for escalations.
- Reply in the original thread, copy the required managers when applicable, and mark the notification with a category to prevent duplicate follow-ups.
Workflow details
- Daily review: Each day at 8:00, the workflow scans vulnerability notifications sent from the shared mailbox during the previous 30 days and ignores follow-up messages or unrelated subjects.
- Response validation: For each original notification, it checks whether a message arrived later in the same conversation from someone other than the shared mailbox, while excluding automatic absence replies. Threads already marked as answered are removed from further follow-up.
- Escalation logic: For unanswered threads, the workflow selects the highest eligible stage: an owner reminder at J+3, a second reminder with the owner’s manager copied at J+6, or an escalation with the manager and second-level manager copied at J+14. If several days were missed, only the highest reached stage is sent.
- Thread-based communication: Each reminder is sent as a reply to the original notification so the owner, vulnerability context, and previous messages remain together. The J+6 and J+14 messages also request a remediation plan or target date, with the J+14 message warning that the risk may be raised at the next security committee.
- Tracking and completion: After sending or detecting a response, the workflow updates the original message with the relevant Outlook category so each stage is sent only once and completed conversations no longer require review. The run returns counts for scanned notifications, detected responses, and reminders or escalations sent.
What changed
The workflow now performs the daily scan, response check, threshold calculation, manager lookup, in-thread reply, and stage tracking automatically. Owners receive the appropriate reminder without a separate handoff, while unanswered items are escalated to management at the defined milestones and answered threads are closed from follow-up.
Work removed
Reviewing vulnerability notification threads individually, searching for later replies, filtering out automatic absence messages, calculating J+3/J+6/J+14 thresholds, checking which reminder stage was already sent, locating managers, composing follow-up messages, copying the appropriate managers, and updating tracking categories.
Expected outcome
Each qualifying vulnerability thread receives no more than one J+3 reminder, one J+6 manager-copy reminder, and one J+14 escalation, removing up to three recurring follow-up decisions per thread.
