WaiveWatch Puts an Expiry Date on Accepted Risk

Field notes

The page separates discovery from exception lifecycle management: scanners such as DefectDojo or Tenable remain responsible for finding vulnerabilities, while the Jira ticket carries the risk decision. An illustrative record includes an accepted-until date, CVE ID, and ticket owner. The proposed nightly process comments on expired issues and transitions them out of the accepted state; a CISA KEV match can instead trigger reopening or escalation and owner notification.