166 terms · 75/46/45
Defense № 044 · class: governance

Vulnerability Management

Continuous process of discovering, classifying, prioritizing, and remediating vulnerabilities.

Term

description · examples · notes

Continuous process of discovering, classifying, prioritizing, and remediating vulnerabilities.

Description

Includes automated scanning (Nessus, Qualys), manual verification, and tracking.

CVSS score helps prioritization, but context (exposure, criticality) is more decisive.

Process: scan → triage → remediate → verify → report.

Mean time to patch (MTTP) is a key metric for measuring effectiveness.

What people often say

  • Scanning without remediation is useless — the process must include fixes.
  • CVSS score without context can lead to wrong priorities.

Covers / does not cover

Covers

  • Automated vulnerability scanning
  • Patch prioritization and tracking
  • Vulnerability status reporting

Does not cover

  • Applying patches (that is patch-management)
  • Business logic testing (that is pen-testing)
  • Real-time protection (that is EDR/WAF)

Mentioned in the news

tags
scanning cvss remediation continuous
◳Composite

Threats

reduces 5

Threats it reduces. Select one to open its page.

Techniques

neutralizes 4

Techniques it neutralizes. Select one to open its page.