Cybersecurity glossary
What is Vulnerability Management?
Learn what vulnerability management is, how teams discover and prioritize security weaknesses, and why remediation needs ownership, evidence, and continuous verification.
Definition
Vulnerability management is the continuous process of identifying, prioritizing, remediating, accepting, and verifying security weaknesses across software, infrastructure, identities, and third-party components.
Why vulnerability management matters
Security teams rarely suffer from too few findings. The hard part is turning scanner output, advisories, bug reports, and threat intelligence into timely risk reduction without exhausting engineering teams.
Vulnerability management creates that operating system. It connects discovery to business impact, assigns accountable owners, tracks exceptions, and verifies that fixes actually reduce exposure.
Inputs that shape vulnerability decisions
Severity
Technical impact scores such as CVSS describe how bad a weakness can be in general.
Exploit activity
Signals such as KEV, EPSS, malware use, and public exploit code show urgency.
Business exposure
Internet reachability, data sensitivity, privilege, and asset criticality determine local risk.
Fix feasibility
Available patches, breaking changes, compensating controls, and owner capacity shape the response.
How a vulnerability becomes managed risk
Discover
Collect findings from scanners, advisories, SBOM monitoring, pentests, bug bounty reports, and incident lessons.
Normalize
Deduplicate records, map assets and components, and enrich findings with severity and exploit data.
Prioritize
Rank based on exposure, exploitability, impact, affected environments, and available remediation paths.
Remediate or mitigate
Patch, upgrade, remove, reconfigure, isolate, or apply compensating controls with a named owner.
Verify
Run fresh scans, tests, or configuration checks to confirm the vulnerable condition is gone.
Report and improve
Track aging, exceptions, recurring causes, and program metrics that guide prevention.
Vulnerability management versus related practices
| Practice | Scope | What it does not do alone |
|---|---|---|
| Vulnerability management | End-to-end lifecycle for security weaknesses and exposure | Guarantee immediate patching without engineering ownership |
| Patch management | Deploying and validating updates across affected assets | Decide every risk priority by itself |
| VEX | Applicability status for a vulnerability in a product | Manage deadlines, exceptions, or customer obligations |
| SBOM monitoring | Watching component inventories for newly disclosed risk | Prove exploitability or implement remediation automatically |
Vulnerability management checklist
- Maintain asset and ownership data accurate enough to route findings quickly.
- Separate newly introduced risk from inherited backlog in developer workflows.
- Prioritize using exploit activity and exposure, not CVSS alone.
- Use VEX or reachability evidence to suppress false positives with documented rationale.
- Set remediation targets that reflect risk and business criticality.
- Require expiry dates and compensating controls for accepted risk.
- Verify fixes with fresh evidence instead of closing tickets on intent.
- Measure recurring root causes so prevention improves over time.
The practical takeaway
Vulnerability Management is not a scanner and not a spreadsheet. It is a continuous risk workflow that turns many imperfect signals into prioritized action and verified remediation.
The best programs reward reducing real exposure, not simply closing the largest number of tickets.
Related security terms
Patch Management
The operational discipline for deploying fixes to vulnerable systems.
Dependency Scanning
A common source of package vulnerability findings.
Vulnerability Exploitability eXchange (VEX)
Machine-readable applicability context that informs triage.
Coordinated Vulnerability Disclosure (CVD)
The process for receiving and coordinating externally reported vulnerabilities.
Attack Surface
The exposed systems and interfaces that influence remediation priority.
Frequently asked questions
What is vulnerability management in simple terms?
It is the ongoing work of finding security weaknesses, deciding which matter most, fixing them, verifying the fix, and documenting any accepted risk.
Is vulnerability management the same as patch management?
No. Patch management deploys fixes. Vulnerability management includes discovery, prioritization, ownership, compensating controls, exceptions, and proof that risk changed.
How should teams prioritize vulnerabilities?
Use severity as a starting point, then factor in exploitation, exposure, asset importance, reachable code, available fixes, business impact, and active threat intelligence.
What is the role of CVSS?
CVSS gives a standardized technical severity score, but it should not be the only prioritization input because it does not fully capture local exposure or attacker activity.
How does VEX help vulnerability management?
VEX can show that a product is not affected, already fixed, affected, or still under investigation, which helps reduce false positives and direct remediation work.
Should all vulnerabilities have the same SLA?
No. Deadlines should reflect risk, exploitation, environment, data sensitivity, compensating controls, and whether the finding is newly introduced or inherited backlog.
What evidence proves remediation worked?
Evidence can include fresh scan results, patched versions, configuration state, tests, deployment records, SBOM or VEX updates, and monitoring that confirms exposure closed.
References
Explore authoritative guidance and frameworks related to vulnerability management.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.