Vulnerability Management

What is vulnerability management?

Vulnerability management is the continuous work of finding security weaknesses in your systems, deciding which matter most, fixing them and checking the fixes worked. Weaknesses include missing patches, insecure configurations, exposed services and flaws in your own code.

It is one of the most basic controls there is, and one of the most often failed. Many serious breaches start with a known flaw that had a fix available.

How does the cycle work?

1. Know what you have. You can’t protect assets you don’t know about, so keep an accurate inventory of hardware, software, cloud services and internet-facing systems.
2. Find the weaknesses, with authenticated scanning, cloud configuration checks, software composition analysis for open-source components, penetration tests and vendor advisories.
3. Prioritise. There are always more findings than time. Rank them by how exposed the asset is, how important it is, and whether the flaw is being exploited.
4. Fix, by patching, reconfiguring or, where you can’t fix quickly, mitigating with compensating controls.
5. Verify with a rescan, and track exceptions with an owner and an end date.

NIST’s SP 800-40 Revision 4 (2022) frames patching as preventive maintenance: a routine, planned cost of running technology, not an emergency each time.

How should you prioritise?

• CVSS scores, maintained by FIRST and now at version 4.0, describe how severe a flaw is in general. They don’t tell you whether anyone is attacking it.
• EPSS, also from FIRST, estimates the probability that a flaw will be exploited in the near future.
• CISA’s Known Exploited Vulnerabilities (KEV) catalog lists flaws CISA has evidence are being exploited in real attacks. A KEV listing is one of the strongest signals to act now, whoever you are.

Combine them with your own context: an exploited flaw on an internet-facing system comes first, whatever its CVSS score.

What changed for US federal agencies in 2026?

On 10 June 2026 CISA issued Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk. It replaces BOD 22-01, which created the KEV catalog, and BOD 19-02 on internet-accessible systems. Remediation deadlines now depend on whether an asset is publicly exposed, whether the flaw is in the KEV catalog, and its technical impact. For the most serious cases agencies must remediate within three days and carry out forensic triage to check whether the asset was already compromised. It binds federal civilian agencies only, but it is a useful model for anyone setting internal deadlines.

What do frameworks expect?

• ISO/IEC 27001 includes a control on managing technical vulnerabilities.
• CIS Controls: Control 7 is continuous vulnerability management.
• PCI DSS requires vulnerabilities to be identified and ranked, critical patches applied promptly, and internal and external scans run regularly.
• NIST CSF 2.0 covers vulnerability identification and management in its Identify and Protect functions.

Common pitfalls

Scanning without fixing, measuring the number of findings instead of the time to fix them, ignoring systems the scanner can’t reach, and treating “no patch available” as “no action needed”. Set target times by risk, report against them, and give exceptions an expiry date.