Cybersecurity · Security operations
Vulnerability management
A scanner can list thousands of weaknesses before lunch; choosing the dozen to fix this week is the actual job. Vulnerability management is a standing programme of discovery, rating, patching and recorded exceptions, and it fails more often through exhaustion than through ignorance. This page separates it from penetration testing and explains why a severity number alone is a poor guide to what matters in your environment.
Why this topic exists: Finding, rating (CVSS) and fixing weaknesses is a continuous programme, separate from testing them: scanners, patch cycles, exceptions (CySA+; SAMM Defect Management).
Vulnerability management is the standing programme that finds weaknesses across an organisation's systems, decides which matter, gets them fixed and records the ones deliberately left open. It runs on a calendar rather than a project plan: scans every week or every day, patch windows every month, reviews of exceptions every quarter. Penetration testing differs: it is a bounded exercise in exploiting what exists, and its findings feed this programme without replacing it. OWASP's SAMM model covers the software side of the same idea in its Defect Management practice, which sits under Implementation.
What a severity score does and does not say
| CVSS metric group | What it describes | Who normally supplies it |
|---|---|---|
| Base | The inherent qualities of the flaw itself | The NVD, for published CVE records |
| Temporal (v2 and v3.x) or Threat (v4.0) | Conditions that change over time, outside the flaw | The organisation, with a calculator; the NVD does not assess these |
| Environmental | How much the flaw matters in a particular estate | The organisation itself |
| Supplemental (v4.0 only) | Additional context around the finding | Optional; the NVD does not assess these either |
The NVD is explicit that CVSS rates severity and is no gauge of risk, and it publishes base scores only. A 9.8 on a server nobody can reach from outside may matter less than a 6.5 on an internet-facing login page. Priority comes from a risk assessment that adds exposure, the value of the asset and whether an attack is known to be in use. The database also notes that where a vendor withholds detail, its analysts score for the worst case, which can push a sparsely described flaw to the top of the scale.
The cycle, and how it breaks
- Inventory: nobody can scan what nobody knows exists, so the programme begins with an asset list that someone keeps current.
- Discovery: authenticated scans, agent data, checks on third-party components and vendor advisories.
- Prioritisation: severity adjusted for exposure and business value, agreed with the teams who own the systems.
- Remediation: a patch, a configuration change or a compensating control, with a deadline tied to priority.
- Exceptions: a written, time-limited acceptance of risk, signed by someone entitled to accept it.
- Verification: a rescan that proves the fix, and figures that show whether the backlog is shrinking.
The characteristic failure is exhaustion. A new team scans everything, forwards a report thousands of lines long, and watches system owners stop opening it. Programmes that last send each owner a short list with reasons and deadlines, and measure how long fixes take rather than how many findings exist. CySA+ treats vulnerability management as one of its four domains, and PenTest+ covers scanning and analysis as the step before exploitation. The parent topic, security operations, shows how this planned work sits beside alert handling, while penetration testing and application security cover the two main sources of findings that do not come from a scanner.
Next to this topic
Concepts to know
Glossary entries with the reason each one matters here.
- Vulnerability Management
The programme itself.
- Security Risk Assessment
Which weakness to fix first is a risk decision.
Certifications that test it
Vendor exams and free certificates; facts, cost and the preparation path are on each page, and the certifications hub has them all.
Frequently asked
- How does a CVE differ from a CVSS score?
- A CVE is an identifier for one publicly disclosed vulnerability, so that everyone refers to it the same way. CVSS is a method for rating how severe that vulnerability is. The NVD attaches base scores to published CVE records.
- How quickly should vulnerabilities be patched?
- There is no universal deadline. Set your own by priority, and shorten it for flaws that face the internet and are known to be exploited. Whatever the policy says, measure against it, because a deadline nobody tracks is not really a policy.
- Is vulnerability management a job title?
- Sometimes, in larger organisations; more often it is a responsibility inside a security operations or infrastructure team. The NICE Workforce Framework lists Vulnerability Analysis as a work role under Protection and Defense.
Courses in the directory
11 courses are filed here; the top 6 by our ranking, details and the provider link on each course page.
Last reviewed 26 September 2026 · Getting Digital