The Risk Rancher Field Manual: Leave the Watchtower
Part of The Risk Rancher Field Manual, a hands-on guide to starting, scaling, and running a vulnerability management program.
Most security programs are built in a watchtower. You buy a scanner, point it at your estate, and on day one it hands you fourteen thousand rows of red: Criticals stacked on Highs stacked on Mediums, every one of them screaming that the sky is falling. You stand up there with your binoculars and you shout, wolves, everywhere, wolves. And down in the dirt, where the actual work happens, nobody moves. Because you have cried critical so many times that the word stopped meaning anything.
That is the whole problem with how we do this. We have confused seeing the danger with doing something about it. A scanner tells you the gate is open. It does not close the gate. It does not even tell you which open gate the cattle are actually walking through. It just counts gates, forever, and calls that security.
This book is about climbing down.
Four words before we go on, because the book leans on them. A scanner is a program that looks for known weaknesses in the systems you run. Your estate is everything you own that it could look at. A vulnerability is a weakness that could be used against you, an unpatched library, a bad setting, an open door, and a finding is one report of one vulnerability on one system. Fourteen thousand rows of red is fourteen thousand findings, labeled Critical or High or Medium by a program that has never met you.
Success is vulnerability management
Here is the thing nobody selling you a platform will say out loud: the sexiest thing in security is doing the boring basics, consistently, for years. Not the zero-day, the flaw nobody has a patch for yet. Not the red-team flex. The unglamorous grind of finding what is broken, deciding what actually matters, getting it fixed, and proving it got fixed. That grind has a name, vulnerability management, and it is the whole game. A program that does it well is secure. A program that does not, is not, no matter how many dashboards it owns.
Security is defined by what you can mend, not by what you know. A list of ten thousand findings is not a security program. It is a to-do list you are losing.
Stop being the lookout. Start being the rancher.
So I am going to ask you to climb down from the tower and get in the dirt. The lookout treats every shadow like a monster. The rancher reads the terrain: a spark in a stone hearth is nothing; the same spark in a dry barn is the end of everything. The lookout throws a three-hundred-page PDF over the fence and wonders why engineering hates them. The rancher walks down, learns how the builders actually work, and hands them something they can use.
That is the shift this whole book runs on. Context over noise. Mending over knowing. The fix over the finding. Everything else is theater.
The engine the whole book builds. Four moves on a loop, and the discipline is running it every week.
The honest disclaimer
I do not do the thing where the author pretends they are not selling anything, so here it is up front. I wrote this manual because I got tired of the BS, the vendors promising real-time, AI-powered, synergistic risk posture to people who are, in reality, drowning in a single spreadsheet. I also wrote a piece of software called Risk Rancher, because some of this work is genuinely robot work and a human should not be doing it by hand.
Every chapter here teaches you to do the thing manually, on real files you download and work yourself: a messy scanner export (the file a scanner writes out, with the mess left in) to triage, an explicit scoring formula to rank it, a ticket template to hand it off, an exception log to defer it, and a remediation log to measure it. Every chapter gives you the thing, the chapters where you score or measure give you an answer key to check your work, and the whole kit lives in one folder, /files/rrfm/. That knowledge stands on its own. You can run your entire program out of this book and never download a single binary. And where the tool earns its keep, I will tell you plainly what it does and what it does not. All of it is free, because what I actually want is for more people to do this work, not to own a subscription; I would rather you did the work than bought the feeling of having done it. The tool makes no network connections at all, which people in this field call air-gapped: you download the list of actively exploited vulnerabilities yourself and hand it over, and later you will see why that is a feature and not a limitation.
Here is the shape of the trail. Part 1 starts you: whether you need a program at all, what you actually own, and how not to be hated by the people who fix things. Part 2 builds the nets: scanners, and when a pentester is worth the money. Part 3 is the engine, the chapters the whole book exists for: triage, remediation, and accepting reality on the record, all worked by hand on one real file. It ends with a short chapter that names every state a finding passes through, so the tool’s screens hold no surprises. Part 4 scales it: what to hand to a machine, and the three numbers that prove any of it worked. A glossary at the end holds every term in plain words, for the second time you meet one. Read it in order the first time; the sample file threads straight through. Pentesters and consultancies, read it the same way. The engine is identical on your own estate or a client’s, and chapter five says where the tool was built with you in mind.
A note on what you need. To read the book, nothing. To do the exercises by hand, a spreadsheet and the files above. The three small scripts in the kit, one to score, one to measure, one to generate a big file, need Python 3, which most machines have. The tool in chapter ten needs Go and git, both free, and the chapter lists them before you start. Chapter four’s optional exercise needs Trivy and a container runtime such as Docker, and says so. Every command the book shows is one you can run or skip; the screens show the same numbers.
No magic. Just less typing.
That is the deal. Leave the watchtower. Get in the dirt. Let us go sort the herd.