The finding was “accepted.” The vendor replied. The Jira ticket flipped to Done.
Three weeks later the same class of exposure is still reachable from the internet — or still unpatched in a fourth-party stack you never named in the ticket — and everyone can point to a closed workflow.
That is remediation theater: the program looks busy and complete while the supply-chain risk that started the work is still open.
Closing work is not the same as closing risk
TPRM, GRC, and security operations are good at moving artifacts. Questionnaires get filed. Exceptions get signed. Vendors get emailed. Tickets get status.
Attackers are not auditing your ticket hygiene. They care whether the vulnerable control plane is still up, whether the forgotten integration still authenticates, and whether “remediated” meant proof or promise.
When teams optimize for closure rates, they accidentally train the organization to celebrate process. Process matters. It is not the outcome. The outcome is residual third-party exposure that a board member or regulator could still ask about next week.
Where theater usually sneaks in
Vendor said patched. The ticket closes on the email. Nobody re-checks version, update level, or whether the internet-facing management plane was ever in scope.
Exception accepted. Time-boxed risk acceptance becomes permanent because the calendar reminder lives in someone’s head, not in the control system.
Wrong owner. Security owns the finding; procurement owns the relationship; the business owns the deadline. The ticket “belongs” to whoever last typed in it — which is how remediation becomes a relay race with no finish line.
Fourth party invisible. The primary vendor is “green.” The MSP or SaaS dependency that actually runs the affected product never entered the ticket. Theater looks like diligence while the real surface sits off-stage.
Same finding, new wrapper. A KEV week reopens the conversation; last quarter’s “remediated” vendor is still in the blast radius; the new ticket does not inherit the old evidence trail.
If any of that feels familiar, the pain is not “we need more severity labels.” The pain is that assessment and remediation are disconnected from live proof.
Security, legal, and the business hear different failures
Security hears: we cannot show continuous verification after vendor chase-down.
Legal hears: we can show correspondence; we struggle to show that residual risk was actually reduced when something is exploited in the wild.
The business hears: TPRM is a blocker that never finishes — or a rubber stamp that finishes too easily — depending on which week you ask.
Remediation that only satisfies one of those three audiences is unfinished work wearing a completed status.
What non-theater looks like (diagnostic)
Programs that keep remediation honest tend to share a few traits:
- Done means evidenced. “Patched” requires a standard of proof (version / UL / config / reachability), not a polite email.
- Exceptions expire in the system, with an owner and a re-open path when external conditions change (KEV, breach in class, new internet exposure).
- Findings map to the real dependency graph — including MSPs and platform vendors — not only the commercial counterparty on the PO.
- Re-open is first-class. A closed ticket can be revived by live signal without waiting for the annual cycle.
- Humans approve residual risk; machines and agents can own collection, chase-down, and verification so approval is not buried under inbox labor.
That last point is where agentic TPRM is supposed to earn its keep: not by inventing a prettier “closed” state, but by keeping assessment → outreach → verification moving under human approval until exposure actually changes.
A one-week anti-theater check
Pick five “remediated” critical or high third-party findings from the last quarter:
- What evidence sits on the ticket besides vendor email?
- Who could re-verify reachability or version this week without starting from zero?
- Does the finding name only the contracted vendor, or also who runs the vulnerable product?
- If CISA added a related KEV tomorrow, would this ticket reopen automatically — or would you discover the gap in a war room?
- Which exceptions are past their written date with no review?
If those answers are thin, you do not have a prioritization problem. You have remediation theater.
Further reading
Earlier practice notes: Green questionnaires, live exposure: why TPRM owners still get surprised after a KEV week and The vendor left. Your data didn’t. Post-engagement risk as a TPRM blind spot.
For a recent Known Exploited Vulnerability — the kind of live signal a closed ticket should be able to absorb — see Rescana’s Security Watchtower advisory on Adobe Commerce / Magento incorrect authorization (CVE-2026-71362).
Soft next step
If security, legal, and risk want remediation that survives a KEV week — without drowning owners in chase-down — we are glad to compare how regulated teams keep proof attached to closure.
