I think I see where I'm not being clear in my question. Please bear with me on this, as I don't understand why it isn't working, and I'm trying more for understanding than function. I can always beat at it until it functions; I'd rather understand why it doesn't work the way I expect.. i.e. where are my expectations wrong?

The record in question is one large string with newlines inside it, right? I'm not sure why the first part of the pattern with alternation would not match the "Remediation Report" and instead use the second half (because it *does* match if there isn't an alternative), unless.. does the regex engine still treat this one large string as multiple strings, separated by the newlines? In other words, why would it skip over a match that works? Does it evaluate each "internal string" in turn?

I updated the example data above to explain how each record is broken up better. I think the Data::Dumper output was a bit confusing. There is only one vulnerability name in each record, so /g shouldn't apply (I believe).