A vulnerability response system, comprising: a non-transitory memory, comprising a vulnerability grouping rule, the vulnerability grouping rule comprising an electronic indication of a group-by field, wherein each vulnerability item of a plurality of vulnerability items corresponds to a configuration item with an attributed vulnerability, wherein the group-by field corresponds to a criteria used when assigning each vulnerability item of the plurality of vulnerability items to a vulnerability group, and wherein the electronic indication of the group-by field is independent of an electronic indication of values stored in group-by fields; and one or more hardware processors configured to execute instructions from the non-transitory memory to perform operations comprising: receiving the plurality of vulnerability items; accessing the vulnerability grouping rule; for each of the plurality of vulnerability items: generating an internal key based upon a value stored in the group-by field indicated in the vulnerability grouping rule; identifying whether any existing vulnerability groups correspond to the internal key; when an existing vulnerability group corresponds to the internal key: grouping the vulnerability item in the existing vulnerability group; otherwise, when none of the existing vulnerability groups correspond to the internal key: generating a new vulnerability group associated with the internal key, and grouping the vulnerability item in the new vulnerability group. a non-transitory memory, comprising a vulnerability grouping rule, the vulnerability grouping rule comprising an electronic indication of a group-by field, wherein each vulnerability item of a plurality of vulnerability items corresponds to a configuration item with an attributed vulnerability, wherein the group-by field corresponds to a criteria used when assigning each vulnerability item of the plurality of vulnerability items to a vulnerability group, and wherein the electronic indication of the group-by field is independent of an electronic indication of values stored in group-by fields; and one or more hardware processors configured to execute instructions from the non-transitory memory to perform operations comprising: receiving the plurality of vulnerability items; accessing the vulnerability grouping rule; for each of the plurality of vulnerability items: generating an internal key based upon a value stored in the group-by field indicated in the vulnerability grouping rule; identifying whether any existing vulnerability groups correspond to the internal key; when an existing vulnerability group corresponds to the internal key: grouping the vulnerability item in the existing vulnerability group; otherwise, when none of the existing vulnerability groups correspond to the internal key: generating a new vulnerability group associated with the internal key, and grouping the vulnerability item in the new vulnerability group. receiving the plurality of vulnerability items; accessing the vulnerability grouping rule; for each of the plurality of vulnerability items: generating an internal key based upon a value stored in the group-by field indicated in the vulnerability grouping rule; identifying whether any existing vulnerability groups correspond to the internal key; when an existing vulnerability group corresponds to the internal key: grouping the vulnerability item in the existing vulnerability group; otherwise, when none of the existing vulnerability groups correspond to the internal key: generating a new vulnerability group associated with the internal key, and grouping the vulnerability item in the new vulnerability group. generating an internal key based upon a value stored in the group-by field indicated in the vulnerability grouping rule; identifying whether any existing vulnerability groups correspond to the internal key; when an existing vulnerability group corresponds to the internal key: grouping the vulnerability item in the existing vulnerability group; otherwise, when none of the existing vulnerability groups correspond to the internal key: generating a new vulnerability group associated with the internal key, and grouping the vulnerability item in the new vulnerability group.