After the risks are determined and the vulnerabilities are prioritized, the security team can start the remediation process.

Here is a basic workflow:

• The Security Manager sets priorities for remediation and assigns remediation tasks to the development team. If the possibility for exploitation is minimal, the security manager might decide to accept some degree of risk and not assign some vulnerabilities for remediation. Monitoring the situation for a set period might be the best course of action in some circumstances.
• Developers fix the highest priority vulnerabilities.
• QA engineers run the appropriate tests against the new version of the application, confirm that remediation was successful, and forward the data to the security manager.