Vulnerability Management

Vulnerability management is the continuous cycle of discovering security weaknesses, ranking them by real-world risk, fixing or mitigating the ones that matter, and verifying the fix — across software, configurations, and infrastructure. It is broader than patching: a vulnerability can be an unpatched server, but also an exposed admin panel, a default credential, a permissive firewall rule, or a misconfigured cloud bucket. Mature programs treat it as an ongoing service with owners and deadlines, not a quarterly scan that produces a spreadsheet.

How it works

The loop has four stages. Discovery combines asset inventory with scanning — authenticated scans of internal systems, external scans of the internet-facing perimeter, and penetration testing to find what scanners cannot. Prioritization is where programs succeed or drown: thousands of findings are ranked by severity, exploitability (CISA's Known Exploited Vulnerabilities catalog marks what attackers actually use), and asset exposure, because a medium flaw on a payment server outranks a critical one on an isolated test box. Remediation hands the ranked work to patch management and configuration owners with defined windows — days for exploited internet-facing flaws, not quarters. Verification rescans to confirm the fix landed, closing the loop that reporting alone never closes.

How to defend

Run the cycle on a cadence and measure latency — time from disclosure to remediation — the way operations teams measure uptime, with internet-facing and actively exploited flaws on the shortest clock. Then extend the model to the layer scanners never see. Attackers choose between a technical vulnerability and a human one, and increasingly pick the human: a persuasive call to the help desk is cheaper than an exploit chain and works on fully patched systems. The same discipline applies — discover susceptibility through phishing simulations, prioritize by role and exposure, remediate with targeted training and process fixes, and verify by re-testing. A human risk score is, in effect, a vulnerability score for the workforce: it tells you where the unpatched people-processes are before an attacker finds them first.