Vulnerability Management: The Process From Discovery to Fix

Vulnerability management is the ongoing process of finding security weaknesses in your systems, deciding which matter most, fixing them and proving the fix worked. New vulnerabilities are disclosed constantly, so it is a continuous, documented cycle rather than a single scan or a yearly test.

What is vulnerability management?

Vulnerability management is a programme, not a product. It covers every known weakness, from a missing operating system patch to an exposed admin interface or a flaw found in a penetration test, and gives each one an owner, a priority and a deadline.

The NCSC’s vulnerability management guidance is a good UK starting point. ISO 27001:2022 Annex A 8.8 (management of technical vulnerabilities) and PCI DSS Requirements 6.3 and 11.3 all expect a working process.

What are the 5 steps of vulnerability management?

The vulnerability management process runs as a repeating five-step lifecycle: identify your assets, find the vulnerabilities on them, prioritise, remediate and verify.

The lifecycle starts with the inventory, because you cannot protect what you do not know about. Unmanaged cloud services, forgotten test servers and end-of-life software are common blind spots. External attack surface management finds the internet-facing ones continuously. Step 5 feeds straight back into step 1: each cycle should leave the inventory more complete than the last.

How do you prioritise vulnerabilities?

Combine severity with likelihood and context, because severity alone flags more findings as critical than most teams can fix at once:

• CVSS, which rates how severe a vulnerability would be if exploited, on a scale of 0 to 10.
• EPSS, which estimates the probability that a vulnerability will be exploited in the wild in the next 30 days.
• Known exploitation, such as an entry in CISA’s Known Exploited Vulnerabilities catalogue or a vendor warning of active attacks.
• Context: whether the system faces the internet, holds sensitive data or sits inside a PCI DSS cardholder data environment.

An actively exploited medium-severity flaw on an internet-facing login page usually comes before a critical flaw on an isolated test server. Prioritising orders the work, but it never overrides a fixed deadline.

What is the CISA KEV catalogue?

The CISA Known Exploited Vulnerabilities (KEV) catalogue is a free, public list of vulnerabilities that the US Cybersecurity and Infrastructure Security Agency has confirmed are being exploited in the wild. Each entry gives the CVE number, the affected product, the required action and a due date, and notes whether the flaw is known to be used in ransomware campaigns. US federal civilian agencies must fix listed vulnerabilities by those dates under Binding Operational Directive 22-01; for everyone else, including UK organisations, the catalogue is one of the strongest prioritisation signals available. If a vulnerability on one of your systems is in the CISA KEV catalogue, treat it as urgent whatever its CVSS score.

What makes a vulnerability management programme work?

Ownership and written rules matter more than tools. A working vulnerability management programme (program in US English) has:

• An owner for every asset, so each finding reaches someone who can fix it.
• Remediation timescales for each priority, written into policy and set inside the fixed deadlines below.
• An exceptions process: when a fix is not possible, record the risk, any compensating control and an expiry date, with sign-off.
• One tracker for scan results, penetration test findings and vendor advisories.
• Simple measures, such as time to fix by priority, overdue items and how much of the inventory is scanned.

Which vulnerability management tools are used?

Most programmes combine four types of tool. A scanner on its own finds problems but does not get them fixed, so the tracking layer matters as much as the scanning layer.

Choose tools for how well they cover your real estate, including cloud accounts, remote laptops and web applications, and how cleanly their results reach your tracker. Scanners only find known issues; the flaws they miss are covered in the penetration testing section below.

Which vulnerability deadlines cannot move?

Some schemes set remediation deadlines that no scoring model can extend:

The full wording is in the standard, available from the PCI SSC document library.

How is vulnerability management different from a vulnerability scan?

Scanning is one input; vulnerability management is the whole process. A vulnerability scan lists possible weaknesses; vulnerability management decides which are real, who fixes them and by when, then checks they stay fixed. A one-off vulnerability assessment sits between the two: a scan plus analyst review that rates the findings, typically as a baseline.

Where do scanning and penetration tests fit?

They feed the discover and verify stages at different depths. Scheduled scanning catches missing patches and known weaknesses between tests and confirms fixes quickly. Penetration testing finds what scanners miss, such as business logic flaws, chained attacks and broken access controls, and its findings belong in the same tracker with the same deadlines. Our penetration test remediation guide covers what to do when the report arrives.

Between tests, breach and attack simulation can check automatically that controls still block and detect known attack techniques, and continuous threat exposure management widens the same cycle to misconfigurations, identities and third parties.

Why Sovereign Secure

Sovereign Secure provides vulnerability scanning services for internal and external systems, with false positives removed, findings prioritised and rescans after fixes, alongside penetration testing. As a PCI SSC-approved QSA company we align scan cycles with PCI DSS 11.3, and we deliver PCI ASV scans through a partner Approved Scanning Vendor. We are also ISO 27001 certified. More terms are in the cyber security glossary.

Next step: to set up a scanning programme or test what your scans miss, request a quote with a rough list of your internal and external systems.