Remediation removes the vulnerability itself, while mitigation reduces the chance or impact of it being exploited and leaves the vulnerability in place. Both lower risk, and most mature programs use them together.
| Remediation | Mitigation | |
|---|---|---|
| What changes | The flaw is removed | The exploit path or impact is reduced |
| Finding status | Closed after verification | Still open, with lower risk |
| Typical actions | Patch, upgrade, code fix, config fix | Compensating control, network block, access restriction |
| Speed | Can take days or weeks with testing | Often hours |
| When to use | Always the end goal | When the fix cannot ship safely yet |
Because a mitigated finding is still technically present, it needs tracking until the permanent fix lands. Teams that mitigate and then lose sight of the finding end up with exposures that quietly reopen when a control changes.