- You cannot fix everything. The goal is to fix the vulnerabilities that attackers are actually using, first.
- Know your assets, scan regularly and rank findings by exposure and exploitation, not just score.
- Agree fix times in advance and report progress simply.
What vulnerability management is
New software flaws are published every day. Vulnerability management is the routine of finding which of them affect you, deciding which matter most and fixing them. Done well it is a steady habit. Done badly it is a long list that nobody trusts.
A routine that works
- 1Know your assets. You can only protect what you can list: devices, servers, cloud services, applications and internet-facing systems.
- 2Scan regularly. Run authenticated scans on a schedule and after major changes, and scan anything exposed to the internet more often.
- 3Prioritise by real risk. Look at whether the flaw is being exploited in the wild, whether the system is reachable from the internet, how sensitive the data is and whether a fix exists.
- 4Fix, or reduce the risk. Patch where you can. Where you cannot, apply a workaround such as blocking access or turning off a feature, and record why.
- 5Check the fix worked. Rescan to confirm the finding has gone.
- 6Report and repeat. Show leaders a few numbers each month and keep the cycle running.
Why severity score is not enough
A scoring system rates how bad a flaw could be in general. It does not know how bad it is in your business. A medium-rated flaw on a public-facing server that attackers are already using may deserve attention before a high-rated flaw on an isolated test machine. Context decides. This is where AI-assisted vulnerability management helps: it combines exploit activity, exposure and asset importance to rank the list for you.
Set fix targets
| Priority | Example situation | Typical target |
|---|---|---|
| Urgent | Exploited now, internet-facing | Within days |
| High | Serious flaw, reachable by attackers | Within a few weeks |
| Medium | Limited exposure or impact | Within a quarter |
| Low | Minimal risk | Next planned maintenance |
These are examples. Agree your own targets and write them down so everyone knows what good looks like.
What to report
- Number of urgent and high findings open, and how long they have been open.
- Share of assets scanned in the last month.
- Time to fix by priority.
- Number of exceptions and when they expire.
Further reading
Independent sources we recommend for more detail.