# Remediate vulnerabilities in bulk or individually

You can use our powerful bulk vulnerability remediation to remediate large groups of vulnerabilities within a product, across products, or target a particular component's vulnerabilities with the click of a button, enabling you to speed triage and ensure remediation consistency of particular vulnerabilities across your product portfolio.

To make the most of your time, you'll likely want to start with the most critical vulnerabilities first, so that you can assess their severity given your particular device, its environment and its use. The **CVSS v3** column in shown by default in the **Vulnerabilities** table. You can click the **Columns** link above the table header row to customize your data display, including adding the **CVSS v2** column.

Initially, all of your vulnerabilities will have a **Status** of **blank**. For CycloneDX status, you'll ultimately want to remediate each of these to either **Exploitable** or **Not affected**. For VEX status, you’ll ultimately want to remediate each of these to either **Affected** or **Not affected**.  Some MDMs use CycloneDX for assigning internal statuses, while using the CycloneDX VEX profile to assign external statuses that will be communicated to customers and other external stakeholders.

## Bulk remediate vulnerabilities

1. In the toolbar of the **Vulnerabilities** table, you'll see a **Remediate N vulns** link. If you have vulnerabilities selected in the table, this N indicates how many you have selected. 
2. Click **Remediate N vulns** to display the **Remediate** panel. 
3. If you're still investigating a vulnerability, choose the interim status for CycloneDX of *In triage*. If you have any information that will help triage these vulnerabilities, you will be able to add that to the **Evidence** field once you have chosen a status. 
4. If you're ready to remediate the vulnerability to a final status, choose the appropriate status. For CycloneDX, depending on the status, you may also need to select a remediation and justification for that remediation. 
5. If you'd also like to add a VEX status, click the **Add CycloneDX VEX** status link. Note that this is the CycloneDX profile of VEX, not OpenVEX, so the statuses are a subset. If you're still investigating a vulnerability, choose the interim status for CycloneDX VEX of *Unknown*.
6. If you select any status besides an interim status for either CycloneDX or CycloneDX VEX, you'll need to provide information to explain this status change in the **Evidence** field. This will provide you with an audit trail for this vulnerability.
7. Click **Remediate N vulnerabilities**. In the **Vulnerabilities** table, you'll see the respective status(es) display in the **CycloneDX status** and **VEX status** columns, respectively.

## Remediate individual vulnerability

1. If you're not familiar with a particular vulnerability, click **Actions > View details** to get all vulnerability information. Close this panel when you're ready to remediate this vulnerability.
2. In the **Vulnerabilities** table, click **Actions > ... > Remediate vulnerability** for the vulnerability that you'd like to remediate. This will display the **Remediate** panel.
3. If you're still investigating a vulnerability, choose the interim status for CycloneDX of *In triage*. If you have any information about the vulnerability that will help triage it, you will be able to add that to the **Evidence** field once you have chosen a status. 
4. If you're ready to remediate the vulnerability to a final status, choose the appropriate status. For CycloneDX, depending on the status, you may also need to select a remediation and justification for that remediation. 
5. If you'd also like to add a VEX status, click the **Add CycloneDX VEX** status link. Note that this is the CycloneDX profile of VEX, not OpenVEX, so the statuses are a subset. If you're still investigating a vulnerability, choose the interim status for CycloneDX VEX of *Unknown*.
6. If you select any status besides an interim status for either CycloneDX or CycloneDX VEX, you'll need to provide information to explain this status change in the **Evidence** field. This will provide you with an audit trail for this vulnerability.
7. Click **Apply remediation**. In the **Vulnerabilities** table, you'll see the respective status(es) display in the **CycloneDX status** and **VEX status** columns, respectively.