Vulnerability Management

Every organization uses technology with weaknesses. New vulnerabilities are disclosed. Software inventories change. Cloud resources appear and disappear. Patches can fix one risk while creating an operational problem.

Vulnerability management gives you a repeatable way to handle that moving target. You identify what is in scope, discover weaknesses, validate the findings, set priorities, choose treatments, verify the result, and measure whether risk is falling.

Use this loop as your mental model:

scope → discover → validate → prioritize → treat → verify
  ↑                                                   ↓
  └──────────── measure, learn, and repeat ───────────┘

The loop is the program. A scanner is only one source of evidence inside it.

Start with the decision, not the tool

A vulnerability is a weakness in software or hardware that can harm confidentiality, integrity, or availability when exploited. A vulnerability finding is evidence that a weakness may affect a particular asset.

Those are different things. A published vulnerability can exist without affecting your environment. A scanner can report a finding that does not match the installed version or reachable configuration. A confirmed weakness can affect an asset whose business importance is still unknown.

Vulnerability management connects four kinds of information:

Asset context — what the asset is, where it runs, what it supports, and who owns it.
Vulnerability evidence — which weakness may apply and why.
Threat context — whether exploitation is possible, expected, or known.
Business context — what could happen to the organization if the asset is compromised or disrupted.

The goal is not to produce the largest finding count. The goal is to make defensible treatment decisions and confirm that those decisions reduce risk.

Define scope and ownership

You cannot assess what you cannot identify. Begin with the assets, software, services, environments, and organizational boundaries that the program covers.

Scope can include:

Vulnerability Management

Start with the decision, not the tool

Define scope and ownership

Relevant careers