Scanning is easy; fixing the right things fast is hard. A mature vulnerability management program turns thousands of scanner findings into a short, prioritized list with clear owners and deadlines.
1. Asset inventory comes first
You can't patch what you don't know exists. Combine sources — EDR, directory services, cloud inventories, network discovery — into a single inventory with an owner, business criticality and internet exposure for each asset. Unknown assets found by scans should trigger an ownership process, not just a ticket.
2. Scan with the right depth and cadence
- Use authenticated scans wherever possible; unauthenticated scans miss most local software vulnerabilities.
- Scan internet-facing assets continuously or at least weekly, and internal systems on a regular schedule.
- Include cloud configurations, container images and third-party software components, not just servers and workstations.
3. Prioritize by real-world risk
CVSS measures severity, not the likelihood of exploitation. Combine several signals:
- Known exploitation: the CISA Known Exploited Vulnerabilities catalogue lists flaws attackers are actively using.
- Exploit likelihood: EPSS, the Exploit Prediction Scoring System from FIRST, estimates the probability of exploitation in the near term.
- Exposure and criticality: an internet-facing system holding sensitive data outranks an isolated test server.
4. Set and enforce remediation SLAs
Define deadlines by risk tier and hold teams to them. For example, known-exploited vulnerabilities on internet-facing systems might require remediation within days, while lower-risk internal findings allow weeks. Choose targets that match your risk appetite and capacity, then measure against them.
5. Manage exceptions deliberately
Some systems can't be patched quickly. Record exceptions with a business owner, a compensating control — isolation, virtual patching, additional monitoring — and an expiry date. Exceptions without expiry dates become permanent risk.
6. Measure outcomes
- Mean time to remediate, by risk tier.
- Percentage of findings remediated within SLA.
- Backlog trend for critical and high findings.
- Coverage: the share of assets scanned with authentication.
Validate the program periodically with penetration testing. Testers exploit the chains of “medium” findings that prioritization models can underrate, showing where your scoring needs adjustment.