---
title: Understanding compensating controls for risk reduction
description: Compensating controls are the measures taken to reduce the risk posed by vulnerabilities that can't be patched immediately. They can be used to mitigate the likelihood or impact of a successful exploit.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-manager-workspace/compensating-controls-overview.html
release: australia
product: Vulnerability Manager Workspace
classification: vulnerability-manager-workspace
topic_type: concept
last_updated: "2026-09-03"
reading_time_minutes: 1
breadcrumb: [Exploring the Vulnerability Manager Workspace, Vulnerability Manager Workspace, Vulnerability Response Workspaces, Unified Security Exposure Management, Security Operations]
---

# Understanding compensating controls for risk reduction

Compensating controls are the measures taken to reduce the risk posed by vulnerabilities that can't be patched immediately. They can be used to mitigate the likelihood or impact of a successful exploit.

**Note:** The compensating controls feature is available for host vulnerabilities only.

Applying compensating controls can help in reducing the risk of a vulnerability.

The following table shows the use cases for compensating controls:

|Use case|Compensating control|
|--------|--------------------|
|A vulnerability in a web server that enables attackers to execute arbitrary code.|Implement a Web application firewall \(WAF\) to block malicious requests to the web server.|
|A vulnerability in an operating system that enables attackers to escalate privileges to root.|Implement an application control to restrict the execution of applications on the host system.|
|A vulnerability in a database server that enables attackers to access sensitive data.|Implement network segmentation to isolate the database server from other hosts and critical systems.|

For more information on the impact of compensating controls on the risk score of a vulnerable item and remediation task, see [Impact of the compensating controls on risk score and expiration date](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/requesting-approving-risk-reduction.md).

A finding can include vulnerable items from more than one CVE or TPE, some of which might be restricted from risk change. You can still proceed with risk change for the eligible items, and the Request Exception form and Bulk Edit modal show how many items are eligible.

**Related topics**  


[Add a compensating control to the library](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/create-compensatory-control.md)

[Restrict or enable risk change for a CVE or TPE](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/disable-risk-reduction.md)