Published · By the Aesparrow Security Research Team
Short answer
Vulnerability management is the continuous process of discovering assets, scanning them for vulnerabilities, prioritising findings by risk, remediating or mitigating them, and verifying the fix. Unlike a one-off vulnerability assessment, it is an ongoing programme with defined owners and remediation timelines.
How to prioritise vulnerabilities
- Severity: CVSS base score as the starting point.
- Exploitability: known exploitation (e.g. the CISA KEV catalogue) or public exploit code.
- Exposure: internet-facing assets first.
- Asset criticality: systems holding sensitive data or supporting key services.
- Compensating controls: WAF rules or segmentation that reduce real risk.
How to remediate vulnerabilities effectively
Set remediation SLAs by priority, assign clear owners, patch or reconfigure, apply compensating controls when a fix is not yet possible, and always re-scan or re-test to verify closure. Track mean time to remediate as a key metric.
The vulnerability management lifecycle
- 1DiscoverMaintain an accurate inventory of assets.
- 2AssessScan and test assets for vulnerabilities.
- 3PrioritiseRank findings by risk, not just severity.
- 4RemediatePatch, reconfigure or mitigate within SLA.
- 5VerifyRe-scan or re-test to confirm the fix.
- 6Report and improveTrack metrics and improve the programme.
FAQ
Frequently Asked Questions
Clear answers about what we do — and what we don’t. If you have any other questions, feel free to reach out to our team.
What is the difference between vulnerability assessment and vulnerability management?
A vulnerability assessment is a point-in-time review; vulnerability management is the ongoing programme that repeats assessment, prioritisation, remediation and verification.