Vulnerability Management
In plain English
Plain definition
Vulnerability management is the continuous process of identifying, prioritising and remediating security weaknesses across systems, using scan evidence, risk scoring and tracked remediation to reduce exploitable exposure over time.
Technical Definition
At a technical level, vulnerability management is a lifecycle process comprising asset discovery, vulnerability scanning or assessment, risk-based prioritisation, remediation or mitigation, and verification. Findings are typically identified against known weakness catalogues (for example CVE identifiers) and scored using severity frameworks such as CVSS, then correlated with asset criticality, exposure and exploitability to produce a prioritised remediation queue. Programme maturity is usually measured through metrics such as mean time to remediate, scan coverage and recurrence of previously closed findings.
Operational Relevance
Vulnerability management underpins an organisation’s ability to reduce its attack surface in a measurable, repeatable way. Operationally, it depends on accurate asset inventory (you cannot assess what you do not know exists), reliable scan scheduling, and a workflow that routes findings to the teams responsible for remediation with clear ownership and deadlines. Without these operational foundations, scanning produces data without reducing risk.
Architecture Relationship
Within a broader security architecture, vulnerability management typically sits alongside patch management, configuration management and endpoint or cloud security posture tooling. It commonly feeds ticketing and workflow systems for remediation tracking, and feeds risk registers and compliance reporting for governance oversight. It is distinct from, but complementary to, detection and response capabilities: vulnerability management aims to close exposure before exploitation, whereas detection and response address exploitation attempts and incidents after they occur.
Example
Consider a platform team running scheduled scans against a fleet of servers each week. A scan identifies a critical vulnerability in an exposed service on several hosts. The finding is triaged: asset criticality and internet exposure raise its priority above other lower-severity findings from the same scan. A remediation ticket is created with a defined deadline based on severity, the fix is applied in a maintenance window following change control, and a follow-up scan confirms the finding no longer reproduces. This closes the loop from detection through to verified remediation.
Misunderstanding
A common misunderstanding is treating vulnerability management as equivalent to vulnerability scanning. Scanning produces a list of findings; management is the complete lifecycle of prioritising, assigning, remediating and verifying those findings. An organisation that scans regularly but has no consistent remediation and verification workflow has vulnerability scanning, not vulnerability management, and its measured risk reduction will not reflect the volume of scan activity performed.
Related Terms
- Patch management
- CVSS (Common Vulnerability Scoring System)
- Attack surface management
- Risk-based prioritisation
- Security posture management
Further Reading
For platform-specific implementation details, terminology and version-specific behaviour, consult the vendor’s official Vulnerability Management technology documentation. Version-specific claims should be confirmed directly against current release documentation before being relied upon operationally.