Security · Exposure Management
Vulnerability Management
The continuous cycle of discovering assets, identifying weaknesses, prioritising by real risk, remediating and verifying.
IntermediateUpdated 2026-09-01
Overview
Vulnerability management is an operational loop, not a quarterly scan. It depends on accurate asset inventory, authenticated scanning or agent telemetry, and a prioritisation model that reflects exploitability and business exposure rather than CVSS alone.
Modern prioritisation blends severity with signals such as known exploitation (CISA KEV), predicted exploitability (EPSS), internet exposure, asset criticality and available compensating controls.
How it works
- 01Agent based assessment covers roaming endpoints; authenticated network scanning covers appliances and infrastructure; cloud posture tools cover configuration.
- 02Findings are enriched with asset owner, exposure and exploit intelligence, then routed to the team that can actually fix them.
- 03Remediation SLAs differ by risk tier, and exceptions are time boxed with compensating controls and named approvers.
- 04Verification closes the loop, rescan or confirm via configuration state that the fix landed everywhere.
Sequence
- 1Asset discovery
- 2Assessment
- 3Prioritisation
- 4Remediation or mitigation
- 5Verification
- 6Reporting
Security considerations
- Treat known exploited vulnerabilities on internet facing systems as incidents, not backlog items.
- Protect scanner credentials; they are highly privileged across the estate.
- Include appliances, firmware, hypervisors, network devices and OT adjacent IT systems, not just servers and laptops.
Common misconfigurations
- Unauthenticated scans only, producing a fraction of real findings.
- No asset ownership, so findings have no accountable remediator.
- Metrics that count findings closed rather than exposure reduced.