What is Vulnerability Management?

A mature program runs as a closed loop rather than a periodic project. Discovery combines authenticated and unauthenticated scanning (Tenable Nessus, Qualys, Rapid7 InsightVM), agent-based continuous scanning on endpoints, and increasingly software composition analysis that inventories open-source dependencies inside applications. Assessment separates real findings from noise: a scanner might flag a vulnerable library version that's actually unreachable because the vulnerable function is never called, or a finding might be a false positive from a version-string mismatch, so assessment requires validating exploitability in context, not just trusting the scanner's severity label.

Prioritization is where most programs live or die, because a mid-size enterprise routinely has tens of thousands of open findings and can only remediate a fraction each cycle. CVSS base score alone is a poor prioritization signal because it ignores whether the vulnerability is actually exploited in the wild. Better programs layer in the temporal score (is a public exploit or Metasploit module available), EPSS (a probability score for exploitation within the next 30 days, built from observed exploitation data), asset criticality (internet-facing beats internal, a domain controller beats a print server), and compensating controls (a vulnerable service that's blocked at the firewall carries lower urgency than the same service exposed to the internet). CISA's Known Exploited Vulnerabilities catalog is now a standard input: a CVE on that list gets remediated on a mandated short timeline regardless of its CVSS score, because active exploitation outranks theoretical severity.

Remediation isn't always a patch. Configuration changes, network segmentation, WAF rules, and disabling an unused feature are all valid mitigations when patching isn't immediately possible, and formal exception processes track accepted risk for findings that can't be remediated on schedule, with an expiration date and an owner. Verification closes the loop with a re-scan confirming the fix actually took effect, because failed patch deployments are common enough that 'we pushed the patch' and 'the vulnerability is closed' are different claims.

Scan cadence itself is a design decision: internet-facing assets are commonly scanned weekly or continuously given how fast attackers weaponize new disclosures, while internal, lower-risk segments might run monthly. Continuous exposure management, an emerging extension of the traditional cycle, layers in attack-path analysis so a moderate vulnerability on an asset one hop from a domain admin account gets treated as higher priority than the same vulnerability on an isolated system, even when the raw CVSS score is identical.