Constrained Nested-Budget Editing: A Recoverable Post-Learning Editor for Fixed-Budget Vulnerability Prioritization

Security teams can review only a small part of a vulnerability queue. We propose Constrained Nested-Budget Editing (CNBE), which uses limited, recorded swaps to apply a learned proposal while protecting successive review frontiers. We test it against a simulated, not analyst-approved, PASTA queue of 100,000 vulnerabilities. On the retrospective Nuclei endpoint, capture within the first 1% increased from 23 to 34 events. This gain came from the proposal ranker: CNBE matched its capture at all declared budgets while changing 2.5–2.7% of queue positions, compared with almost all positions for full replacement. On 102,244 previously untouched cases from the same period, top-1% capture was 30 versus 20. A simpler comparator with approximately the same number of changed positions matched CNBE at 0.5% and 1% on three endpoints; CNBE captured one or two more events at 2% on two endpoints. The selected reliability threshold and non-inferiority rules did not bind in the original frozen experiment. CNBE therefore provides an auditable, bounded way to deliver a learned ranking at fixed budgets; it does not independently increase predictive accuracy. The evaluation does not establish performance on a real approved queue or at a future cutoff.