They aren’t wrong. First you have a regulatory landscape that isn’t going to evaluate every CVE and every implementation so if you work in a regulated sector yo

They aren’t wrong. First you have a regulatory landscape that isn’t going to evaluate every CVE and every implementation so if you work in a regulated sector you get no CVE over X policy by default. Second for a large enterprise with a lot of developed in house applications it’s impossible to validate every implementation and use case; so the default policy is updated or file for an exception in the exception process is upto the application owner in the business to make an argument to the security team why it’s not applicable. No CVE policy is actually the smart way of doing things because it does moves the load form your security team which will be understaffed compared to the development staff (doesn’t matter if it’s in house or not) and they have better things to focus on than going over SCA or Vuln scanning CVE reports.