Vulnerability management is the ongoing program that finds weaknesses, prioritizes them, applies fixes, and checks that the risk actually fell.
Scans and assessments are inputs, while this program owns the queue until a fix is verified or a risk is formally accepted.
How it works
The loop is discover, prioritize, fix, and confirm.
A pile of unread scan files is not management, because nobody has checked that the weakness is gone.
Time targets should depend on severity and exposure.
Exceptions that grow old need a leader who can see them, not only a ticket that stays open.
Concrete examples
- Internet facing systems are patched within a set number of days, and exceptions are recorded.
- A recurring meeting assigns owners to the highest risks still open.
- A fix is checked again by a later scan and by a configuration review.
Protective measures
- Set time targets that reflect severity and how exposed the system is.
- Give system owners a clear queue instead of an unread report.
- Verify the fix instead of trusting a ticket status alone.
- Show aging exceptions to leadership on a regular rhythm.