Vulnerability Management is the continuous process of identifying, assessing, prioritising and addressing security weaknesses in systems, software, devices, configurations and other technology assets. A vulnerability is a weakness that can potentially be exploited to compromise confidentiality, integrity, availability or other security properties. Vulnerability management is broader than vulnerability scanning because scanning is primarily an identification activity, whereas management includes discovery, validation, prioritisation, remediation, verification and ongoing reassessment. The objective is not simply to produce a list of vulnerabilities but to reduce meaningful security exposure through an accountable lifecycle. NIST's patch-management guidance places vulnerability management alongside risk assessment, remediation and maintenance because technical weaknesses must ultimately be translated into managed corrective actions.
A mature vulnerability-management lifecycle begins with asset discovery and inventory. An organisation cannot reliably manage weaknesses in systems it does not know exist. Assets can include servers, workstations, network devices, cloud resources, applications, containers, virtual machines, software components, firmware and externally exposed services. Identification may use authenticated scanners, network discovery, endpoint agents, cloud APIs, software inventories and configuration-management information. Asset context is essential because the same vulnerability can represent very different risks depending on whether the affected system is Internet-facing, isolated, business-critical, unsupported or handling sensitive information. Vulnerability management therefore depends on accurate asset management rather than operating as an isolated scanning function.
Vulnerability identification can involve network vulnerability scanners, authenticated host scans, application security testing, dependency analysis, configuration assessment, code analysis, cloud security assessment and external attack-surface monitoring. Vulnerabilities are commonly associated with identifiers such as CVE numbers, while severity may be represented using scoring systems such as CVSS. However, a severity score is not equivalent to an organisation-specific risk assessment. Exploit availability, asset exposure, business criticality, compensating controls, affected data and active exploitation can materially change remediation priority. A high numerical score on an isolated laboratory system may require less immediate attention than a moderately scored weakness affecting an exposed critical service.
Prioritisation is therefore one of the most important parts of vulnerability management. A simple severity-ranked queue can become impractical in large environments because organisations may have thousands or millions of findings. Effective prioritisation can incorporate exploitability, evidence of active exploitation, Internet exposure, asset criticality, privileges required for exploitation, affected data, availability of remediation and existing controls. Threat intelligence can improve this process by identifying vulnerabilities being actively exploited or associated with relevant campaigns. The objective is to direct limited remediation resources towards weaknesses whose reduction produces the greatest meaningful reduction in organisational risk.
Remediation can involve installing a software patch, upgrading a product, changing a configuration, removing unnecessary software, disabling an exposed service, replacing unsupported technology or implementing another control that reduces exploitability. Patching is particularly important because it directly corrects many software vulnerabilities, but patching itself requires planning, testing and verification. NIST defines enterprise patch management as identifying, prioritising, acquiring, installing and verifying patches, updates and upgrades. Vulnerability management is broader because some weaknesses cannot be solved by a patch and may instead require configuration changes, architectural changes, compensating controls or technology replacement.
Compensating controls are sometimes necessary when permanent remediation cannot be performed immediately. Network segmentation, access restrictions, application controls, virtual patching, WAF rules or additional monitoring can reduce exposure while a permanent fix is prepared. These measures should not be confused with eliminating the vulnerability itself. For example, a WAF can sometimes block exploit traffic against a vulnerable web application, but the underlying application defect remains present. Compensating controls also require maintenance because they can become ineffective when architectures, attack techniques or application behaviour change. Vulnerability management should therefore track both unresolved weaknesses and temporary protections.
Verification is essential because a vulnerability record should not be considered resolved merely because a patch ticket was closed. Verification can involve rescanning the affected asset, checking software versions, validating configuration state, reviewing deployment records or testing the original weakness. Remediation can also introduce new operational problems, so change management and post-remediation testing are relevant. Metrics may include time to remediate, percentage of assets covered, age distribution of unresolved findings, recurrence rates and remediation performance against defined service levels. Such metrics should be interpreted in context because a reduction in reported findings can result from improved remediation, changes in scanning coverage or changes in asset inventory.
Vulnerability management connects directly with other security disciplines. Asset management provides the inventory, threat intelligence provides information about active exploitation and adversary behaviour, SOC telemetry can reveal attempts to exploit vulnerable systems, EDR can provide evidence of endpoint compromise, WAF and firewall controls can reduce exposure, and incident response handles vulnerabilities discovered during active incidents. Vulnerability management also feeds risk-management processes because unresolved weaknesses represent potential pathways to compromise. NIST's enterprise patch-management guidance explicitly connects patching with reducing the likelihood of compromises, data breaches and operational disruption.
