Managing Vulnerabilities

A scanner returns ten thousand findings, most rated High or Critical, and the team can patch a few hundred a month. Vulnerability management is the function that decides which few hundred — and the default of "sort by CVSS descending" is close to the worst possible order, because CVSS measures theoretical severity, not the probability that this vulnerability, on this asset, gets exploited.

The whole discipline is turning an undifferentiated backlog into a defensible order of operations that a limited team can actually execute.

When to Use

• Triaging vulnerability scanner output into a remediation order
• Deciding what to patch first under a fixed remediation budget
• Building or reviewing a risk-based vulnerability management process
• Explaining why a CVSS 9.8 is not this week's top priority
• Deciding whether a finding warrants an exception rather than a fix