Glossary
Vulnerability management
Vulnerability management is the ongoing process of discovering, prioritising, remediating and verifying weaknesses across an estate.
Updated 2 Sept 2026
In detail
It is a cycle, not a scan. Discovery builds and maintains an asset inventory and finds known weaknesses on it; prioritisation decides what to fix first; remediation is carried out by whoever owns the system; verification confirms the fix. The hard parts are rarely technical — they are asset ownership, exception handling and agreeing service levels with engineering teams.
Why it matters
Scanners produce more findings than any team can patch, so prioritisation quality determines real risk reduction. Severity alone is a poor guide: CISA's Known Exploited Vulnerabilities catalogue and exploitation-likelihood scoring identify the small subset under active attack, which is where remediation effort belongs first.
Examples
- Prioritising an internet-facing VPN appliance CVE listed in the CISA KEV catalogue over a higher-CVSS flaw on an isolated internal host.
- Tracking remediation SLAs by severity: critical in 7 days, high in 30, and reporting overdue items to system owners.
- Re-scanning after a patch window to confirm findings actually closed rather than trusting the change ticket.