Vulnerability management
Vulnerability management is the ongoing process of discovering, prioritising, remediating and verifying weaknesses across an estate.
Updated 2 Sept 2026
In more detail
It is a cycle, not a scan. Discovery builds and maintains an asset inventory and finds known weaknesses on it; prioritisation decides what to fix first; remediation is carried out by whoever owns the system; verification confirms the fix. The hard parts are rarely technical — they are asset ownership, exception handling and agreeing service levels with engineering teams.
Why Vulnerability management matters
Scanners produce more findings than any team can patch, so prioritisation quality determines real risk reduction. Severity alone is a poor guide: CISA's Known Exploited Vulnerabilities catalogue and exploitation-likelihood scoring identify the small subset under active attack, which is where remediation effort belongs first.
How it works
Authenticated and unauthenticated scanners, cloud configuration checks and software composition analysis feed a findings store. Each finding is scored — commonly with CVSS for severity, supplemented by exploitation data and asset exposure — assigned an owner and a due date, tracked to closure, then re-scanned to verify. Accepted risks are documented with an expiry date.
Examples
- Prioritising an internet-facing VPN appliance CVE listed in the CISA KEV catalogue over a higher-CVSS flaw on an isolated internal host.
- Tracking remediation SLAs by severity: critical in 7 days, high in 30, and reporting overdue items to system owners.
- Re-scanning after a patch window to confirm findings actually closed rather than trusting the change ticket.
How it is detected or measured
Programme health is measured by asset coverage, mean time to remediate by severity, percentage of KEV-listed findings open, and recurrence of previously closed findings.
Where this matters
- Vulnerability Management
The discipline of finding, prioritising and driving out vulnerabilities at scale — and why prioritisation, not scanning, is the job.
- Website Security Checklist
A prioritised checklist covering access, patching, backups, monitoring and response — ordered by how much risk each control removes.
Sources
- Known Exploited Vulnerabilities Catalog — CISA
Authoritative list of vulnerabilities under active exploitation.
- CVSS v4.0 Specification — FIRST
How severity scores are calculated and what they do not measure.