Vulnerability management process: from finding to fix

The six steps of the process

• Inventory: Without a complete asset inventory, systems go unchecked (see attack surface management).
• Discover: scanners, agents and cloud connections deliver findings.
• Assess: combine severity, exploitability, reachability and business value.
• Prioritize: set the order by risk and assign deadlines.
• Remediate: patch, configuration change or compensating control.
• Re-test and document: scan again, record the result.

Why CVSS alone is not enough

The CVSS score describes the technical severity of a vulnerability – not the risk to your business. A large share of vulnerabilities with a high CVSS score is never exploited or affects systems that are not even reachable. Working strictly by CVSS ties up capacity in the wrong places.

Better signals: EPSS, KEV and attack paths

• EPSS (Exploit Prediction Scoring System by FIRST) estimates the probability that a vulnerability will be exploited in the next 30 days.
• The KEV catalog of the US agency CISA lists vulnerabilities that are known to be actively exploited.
• Reachability and attack paths show whether a vulnerability can be reached from outside and leads to critical systems – this is what exposure management delivers.

Deadlines and evidence

Remediation deadlines should be based on risk, for example a few days for actively exploited, reachable vulnerabilities on critical systems. For audits under ISO/IEC 27001 (Annex A 8.8 “Management of technical vulnerabilities”) and for NIS2, what counts is that the process, deadlines and remediation are documented in a traceable way.

What matters in vulnerability management software

• Consolidation of all sources without duplicates
• Prioritization by exploitability and reachability, not just CVSS
• Tasks with context for the responsible teams
• Automatic re-testing after remediation
• Reports with history for auditors and management