{"id":11908,"date":"2026-11-15T07:30:00","date_gmt":"2026-11-15T07:30:00","guid":{"rendered":"https:\/\/www.cotocus.com\/blog\/?p=11908"},"modified":"2026-11-16T12:30:00","modified_gmt":"2026-11-16T12:30:00","slug":"six-vulnops-myths-retold","status":"publish","type":"post","link":"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/","title":{"rendered":"Six VulnerabilityOps Myths I Keep Hearing, and What the Data Says"},"content":{"rendered":"

Years ago a training cohort of mine did something I still think about. I asked a room of capable engineers how they knew a security fix had worked, and six people gave six different answers, each delivered with total confidence. One said the ticket was closed. Another said the scanner stopped complaining. A third said the vendor told them. Nobody was careless; they were repeating folklore that sounds right. VulnerabilityOps is, among other things, a clean-up of that folklore. Six of those myths come up again and again, so I have lined them up against what the evidence shows.<\/p>\n

Myth one: “A low exploit score means we are safe”<\/h2>\n

The exploit prediction score is a useful instrument, and for that reason people over-trust it. A figure like five percent sounds trivially small. Read it as a plain probability and it says that roughly one case in twenty will see attack activity inside a month, which no sensible engineer would accept for a payment system. The overall base rate is lower, with 1.5 to 3 percent of published flaws seeing exploitation in a month, so a five percent score is in fact several times the norm.<\/p>\n

What to do instead:<\/strong> use the score to order work inside a deadline bucket, not to cancel work. And remember the model version changes: the fifth revision replaced the fourth on 15 June 2026, so historical comparisons need care.<\/p>\n

Myth two: “Resolved means fixed”<\/h2>\n

This is the folklore my students gave me most often. A ticket status records that someone clicked a button. Only four things confirm a fix: a re-scan run with credentials, a passing settings test, a changed container fingerprint, or a challenge that survived formal review. The 2023 case involving a widely deployed gateway appliance shows the stakes. The software update alone was not sufficient, because attackers who had already stolen session tokens could carry on past the patch, and the vendor’s advice included ending every active and persistent session.<\/p>\n

What to do instead:<\/strong> write the closure evidence into the hand-off record before work starts, so nobody has to argue about it afterwards.<\/p>\n

Myth three: “If it is on the exploited list, someone is attacking us right now”<\/h2>\n

The government list of known exploited flaws is evidence that exploitation has been observed somewhere at some point, and that is more valuable than a score. It is not a live threat feed for your estate. The agency itself cautions that listing an old flaw does not mean it is under active attack today. Treat a listing as a strong reason to prioritise and a prompt to check your exposure, not as proof of a current intrusion.<\/p>\n

That distinction affects the tone of your response. A listed flaw on a public system deserves urgency and perhaps a forensic look. A listed flaw on a sealed internal box deserves a plan, not a fire drill.<\/p>\n

Myth four: “Our scanner covers everything because it ran”<\/h2>\n

Scanning without credentials misses local flaws entirely, since it sees only what a stranger on the network would see. Worse, when a scan account breaks, say after a key rotation, the number of findings drops and the dashboard turns a cheerful green. In one published worked example, 80 hosts lost their scanning credentials at once while headline coverage still read nearly 96 percent. There are known traps in popular tools too: a login check might succeed while the separate package-inventory check fails on Linux, so results look complete when they are not.<\/p>\n

What to do instead:<\/strong> measure credentialed coverage over a seven-day window and alert on any dip.<\/p>\n

Myth five: “Critical and High tell us what to do”<\/h2>\n

Those labels are a description of severity. They do not prescribe actions, and the custodians of the scoring standard themselves warn against leaning on a base figure as the only gauge of danger. Even so, many policies read like a menu: Critical in 7 days, High in 30. Policies built that way inherit the label’s blind spots. They treat a theoretical flaw on an isolated test server like an actively exploited one on a public site.<\/p>\n

The modern alternative is deadlines computed from facts about the specific situation. A June 2026 US federal directive uses four: public exposure, known-exploited status, whether the attack is automatable and how severe the technical impact is. It binds only federal civilian agencies, but its logic is easy to copy.<\/p>\n

Where the Atlas weighs in on all this<\/h2>\n

When I want a neutral summary to send to a team lead, I point them to an Ops Atlas page that maps the discipline and lists its common myths<\/a>. It is short, honest about the term still being young, and clear about where the evidence is firm and where it is only a convention.<\/p>\n

Myth six: “Our goal is zero criticals”<\/h2>\n

Goals phrased as a count measure the pile, not the movement. A team can hit zero criticals one day simply because the scanner broke, and it can miss the goal next week because a public disclosure added a dozen. What tells you whether you are winning is flow: how many items arrive versus how many are verified closed in each tier. When arrivals exceed closures the queue is growing, whatever the headline says.<\/p>\n

There is a subtle trap here too. The age of the oldest items in the queue can fall while the queue grows, because new arrivals dilute the old ones. In the Atlas example, the 90th-percentile age dropped from 30 to 12 weeks while the backlog rose by 25 per week. Report age and saturation together, always.<\/p>\n

An exercise to run with your own team<\/h2>\n

Folklore is hard to dislodge with lectures, so I now use a short exercise. Pick three recently closed findings at random and ask a different person to prove, in under five minutes, that each one is truly gone. Watch what they reach for. If they open the ticket, you have found myth two. If they open the scanner dashboard without checking that the scan was credentialed, you have found myth four. If they start by quoting a severity label, you have found myth five.<\/p>\n

The exercise is deliberately friendly. Nobody is graded; the point is to reveal the default reflexes of a team so you can swap them for better ones. In my experience the first round usually reveals that closure evidence is stored nowhere, which is why I suggest adding a required evidence field to the ticket template. The second round tends to be faster and a lot more satisfying, because people know what to reach for.<\/p>\n

It also pays to keep a short list of exceptions that came out of the exercise. If a finding cannot be proven closed, either the fix is incomplete or the evidence rule is unrealistic for that kind of asset. Both are valuable discoveries, and both belong on the agenda for the next monthly flow review.<\/p>\n

Why these myths survive<\/h2>\n

They survive because each one has a kernel of truth and each one saves effort. Ticket statuses are easy to check. Labels are easy to read. A green dashboard is pleasant to present. Correcting the folklore costs a little more effort up front, mostly in writing down evidence rules, tagging assets and counting arrivals, and then pays you back every month in arguments you no longer have.<\/p>\n

If you are building skills on this subject, our pieces on training for modern operations roles<\/a> and on speeding up problem resolution with operations platforms<\/a> are good neighbours to this one, since evidence-based habits carry across disciplines.<\/p>\n

As for my cohort, the following week I repeated the question. This time they gave one answer, in unison: show me the rescan.<\/p>\n","protected":false},"excerpt":{"rendered":"

Six folk beliefs about scoring, closure, scanning and goals in vulnerability handling, each tested against public evidence and replaced with a better habit.<\/p>\n","protected":false},"author":37,"featured_media":11909,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[147],"tags":[],"class_list":["post-11908","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"yoast_head":"\nSix VulnerabilityOps Myths I Keep Hearing, and What the Data Says - Cotocus<\/title>\n<meta name=\"description\" content=\"Six VulnerabilityOps myths busted: low exploit scores, resolved tickets, exploited lists, scanner coverage, severity labels and zero-critical goals.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Six VulnerabilityOps Myths I Keep Hearing, and What the Data Says - Cotocus\" \/>\n<meta property=\"og:description\" content=\"Six VulnerabilityOps myths busted: low exploit scores, resolved tickets, exploited lists, scanner coverage, severity labels and zero-critical goals.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/\" \/>\n<meta property=\"og:site_name\" content=\"Cotocus\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-15T07:30:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-16T12:30:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.cotocus.com\/blog\/wp-content\/uploads\/2026\/11\/b2a-banner-2889990-banner.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Nikhil Farooqui\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nikhil Farooqui\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/six-vulnops-myths-retold\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/six-vulnops-myths-retold\\\/\"},\"author\":{\"name\":\"Nikhil Farooqui\",\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/#\\\/schema\\\/person\\\/419007bef27e8d85890550d783b96c50\"},\"headline\":\"Six VulnerabilityOps Myths I Keep Hearing, and What the Data Says\",\"datePublished\":\"2026-11-15T07:30:00+00:00\",\"dateModified\":\"2026-11-16T12:30:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/six-vulnops-myths-retold\\\/\"},\"wordCount\":1282,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/six-vulnops-myths-retold\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/b2a-banner-2889990-banner.png\",\"articleSection\":[\"DevOps\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/six-vulnops-myths-retold\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/six-vulnops-myths-retold\\\/\",\"url\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/six-vulnops-myths-retold\\\/\",\"name\":\"Six VulnerabilityOps Myths I Keep Hearing, and What the Data Says - Cotocus\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/six-vulnops-myths-retold\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/six-vulnops-myths-retold\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/b2a-banner-2889990-banner.png\",\"datePublished\":\"2026-11-15T07:30:00+00:00\",\"dateModified\":\"2026-11-16T12:30:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/#\\\/schema\\\/person\\\/419007bef27e8d85890550d783b96c50\"},\"description\":\"Six VulnerabilityOps myths busted: low exploit scores, resolved tickets, exploited lists, scanner coverage, severity labels and zero-critical goals.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/six-vulnops-myths-retold\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/six-vulnops-myths-retold\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/six-vulnops-myths-retold\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/b2a-banner-2889990-banner.png\",\"contentUrl\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/b2a-banner-2889990-banner.png\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/six-vulnops-myths-retold\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Six VulnerabilityOps Myths I Keep Hearing, and What the Data Says\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/\",\"name\":\"Cotocus\",\"description\":\"Shaping Tomorrow\u2019s Tech Today\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/#\\\/schema\\\/person\\\/419007bef27e8d85890550d783b96c50\",\"name\":\"Nikhil Farooqui\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d855702dac00a5af0405bb329101be495718d611233e52c86fe360c8fca6f6dc?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d855702dac00a5af0405bb329101be495718d611233e52c86fe360c8fca6f6dc?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d855702dac00a5af0405bb329101be495718d611233e52c86fe360c8fca6f6dc?s=96&d=mm&r=g\",\"caption\":\"Nikhil Farooqui\"},\"url\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/author\\\/nikhil-farooqui\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Six VulnerabilityOps Myths I Keep Hearing, and What the Data Says - Cotocus","description":"Six VulnerabilityOps myths busted: low exploit scores, resolved tickets, exploited lists, scanner coverage, severity labels and zero-critical goals.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/","og_locale":"en_US","og_type":"article","og_title":"Six VulnerabilityOps Myths I Keep Hearing, and What the Data Says - Cotocus","og_description":"Six VulnerabilityOps myths busted: low exploit scores, resolved tickets, exploited lists, scanner coverage, severity labels and zero-critical goals.","og_url":"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/","og_site_name":"Cotocus","article_published_time":"2026-11-15T07:30:00+00:00","article_modified_time":"2026-11-16T12:30:00+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.cotocus.com\/blog\/wp-content\/uploads\/2026\/11\/b2a-banner-2889990-banner.png","type":"image\/png"}],"author":"Nikhil Farooqui","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Nikhil Farooqui","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/#article","isPartOf":{"@id":"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/"},"author":{"name":"Nikhil Farooqui","@id":"https:\/\/www.cotocus.com\/blog\/#\/schema\/person\/419007bef27e8d85890550d783b96c50"},"headline":"Six VulnerabilityOps Myths I Keep Hearing, and What the Data Says","datePublished":"2026-11-15T07:30:00+00:00","dateModified":"2026-11-16T12:30:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/"},"wordCount":1282,"commentCount":0,"image":{"@id":"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cotocus.com\/blog\/wp-content\/uploads\/2026\/11\/b2a-banner-2889990-banner.png","articleSection":["DevOps"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/","url":"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/","name":"Six VulnerabilityOps Myths I Keep Hearing, and What the Data Says - Cotocus","isPartOf":{"@id":"https:\/\/www.cotocus.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/#primaryimage"},"image":{"@id":"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cotocus.com\/blog\/wp-content\/uploads\/2026\/11\/b2a-banner-2889990-banner.png","datePublished":"2026-11-15T07:30:00+00:00","dateModified":"2026-11-16T12:30:00+00:00","author":{"@id":"https:\/\/www.cotocus.com\/blog\/#\/schema\/person\/419007bef27e8d85890550d783b96c50"},"description":"Six VulnerabilityOps myths busted: low exploit scores, resolved tickets, exploited lists, scanner coverage, severity labels and zero-critical goals.","breadcrumb":{"@id":"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/#primaryimage","url":"https:\/\/www.cotocus.com\/blog\/wp-content\/uploads\/2026\/11\/b2a-banner-2889990-banner.png","contentUrl":"https:\/\/www.cotocus.com\/blog\/wp-content\/uploads\/2026\/11\/b2a-banner-2889990-banner.png","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/www.cotocus.com\/blog\/six-vulnops-myths-retold\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.cotocus.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Six VulnerabilityOps Myths I Keep Hearing, and What the Data Says"}]},{"@type":"WebSite","@id":"https:\/\/www.cotocus.com\/blog\/#website","url":"https:\/\/www.cotocus.com\/blog\/","name":"Cotocus","description":"Shaping Tomorrow\u2019s Tech Today","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.cotocus.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.cotocus.com\/blog\/#\/schema\/person\/419007bef27e8d85890550d783b96c50","name":"Nikhil Farooqui","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d855702dac00a5af0405bb329101be495718d611233e52c86fe360c8fca6f6dc?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d855702dac00a5af0405bb329101be495718d611233e52c86fe360c8fca6f6dc?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d855702dac00a5af0405bb329101be495718d611233e52c86fe360c8fca6f6dc?s=96&d=mm&r=g","caption":"Nikhil Farooqui"},"url":"https:\/\/www.cotocus.com\/blog\/author\/nikhil-farooqui\/"}]}},"_links":{"self":[{"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/posts\/11908","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/users\/37"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/comments?post=11908"}],"version-history":[{"count":1,"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/posts\/11908\/revisions"}],"predecessor-version":[{"id":12014,"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/posts\/11908\/revisions\/12014"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/media\/11909"}],"wp:attachment":[{"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/media?parent=11908"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/categories?post=11908"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/tags?post=11908"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}