Vulnerability management is the operational discipline of finding, prioritizing, and fixing security weaknesses. It's repetitive work that never ends — new vulnerabilities are disclosed continuously.
This page covers the practices that make it sustainable.
The vulnerability management lifecycle:
Each step has its own tooling and process.
Scan your own systems regularly:
Different scans find different things. A mature program runs several.
You can't scan what you don't know about. Maintain:
Without inventory, scans miss things; remediation has no owner.
Discovered vulnerabilities almost always exceed remediation capacity. Prioritize.
Common Vulnerability Scoring System. 0-10 scale; CVSS 9+ = critical; CVSS 7+ = high.
CVSS is a starting point. Real prioritization considers:
Known to be exploited in the wild? CISA's KEV catalog tracks this.
A CVSS 7 actively exploited > a CVSS 9 not yet exploited.
The vulnerability is in code/system that's actually exposed? An RCE in a service behind a VPN is different from an RCE on the public internet.
How many systems? Critical paths or backend?
Public exploit code makes the vulnerability much higher priority.
A reasonable framework:
Apply the vendor's update. Most vulnerabilities have patches.
For library vulnerabilities, update the library. For OS vulnerabilities, OS update.
Sometimes patching isn't possible quickly. Mitigations:
Mitigations buy time until patches deploy.
Sometimes the cost of remediation exceeds the risk. Document; review periodically; revisit when context changes.
This requires accountability — risk owners, formal acceptance, periodic review. Not "we won't fix it because it's hard."
After remediation, verify:
Without verification, you don't actually know the vulnerability is fixed. The patching script ran; that's not the same as the vulnerability being gone.
Vulnerability management metrics:
Reports for:
Dependabot auto-merges minor updates after CI passes. Reduces manual work for low-risk updates.
Every service has an owner who's accountable for vulnerabilities. Without ownership, fixes don't happen.
Critical: 7 days. High: 30 days. Medium: 90 days. Low: 180 days. Vary based on org's risk tolerance.
Don't wait for the quarterly scan. Continuous scanning catches issues quickly.
For risk acceptance: documented; risk-owner-approved; time-bounded; reviewed.
If you find a vulnerability in someone else's software, disclose responsibly. Coordinated disclosure: tell the vendor; give time to fix; publish after.
Vulnerability Disclosure Program: how external researchers report vulnerabilities to you. Even if no bounty, having a process matters.
For organizations starting vulnerability management:
The goal isn't zero vulnerabilities (impossible); it's sustainable management of the ones that matter.