Blog
Vulnerability Management
The discipline of finding, prioritising and driving out vulnerabilities at scale — and why prioritisation, not scanning, is the job.
Published 10 Aug 2026 · Updated 29 Aug 2026 · 2 min read
Short answer
Vulnerability management is the continuous process of discovering vulnerabilities across an estate, prioritising them by real exploitability and asset importance, driving remediation with the teams that own the systems, and measuring whether risk is actually falling. The hard part is prioritisation and follow-through, not scanning.
What does the role actually involve?
- Maintaining coverage: every asset in scope, scanned on a known cadence.
- Deduplicating and validating findings before they reach engineering teams.
- Prioritising with asset criticality, exposure and exploitation evidence.
- Negotiating remediation timelines and tracking exceptions.
- Reporting trends to management in terms of risk reduction.
How should findings be prioritised?
| Input | Why it matters |
|---|---|
| Known exploited status | Evidence of real-world exploitation outranks theoretical severity |
| Internet exposure | Externally reachable systems are attacked first |
| Asset criticality | Business impact determines urgency |
| Compensating controls | Mitigations legitimately reduce urgency when documented |
| Remediation cost | Determines sequencing, never whether a critical is fixed |
What is the learning path?
STEP 01
Understand the estate
Learn how asset inventory and CMDB data are built and where they lie.
STEP 02
Learn one scanner deeply
Coverage, authentication, credentialed scanning and false positive patterns.
STEP 03
Read vulnerability sources
CVE records, vendor advisories and exploited-vulnerability catalogues.
STEP 04
Practise the negotiation
Turning a finding into an owned, dated, tracked remediation task is the actual skill.
Sources
- Known Exploited Vulnerabilities Catalog — CISA
- CVE Program — CVE
Prefer summary updates? Subscribe to the newsletter.