The Vulnerability Management Lifecycle

Vulnerability management (VM) is not a one-time scan; it is a continuous program. Treating it as a lifecycle ensures weaknesses are reliably found, judged, fixed, and confirmed closed, rather than piling up in an ignored report.

The classic loop is: discover, assess, prioritize, remediate, verify, then repeat. Each phase has owners, inputs, and outputs.

You cannot protect what you cannot see. Discovery builds and maintains an accurate asset inventory and finds weaknesses across it:

• Hosts, cloud instances, containers, services, and software versions.
• Authenticated and unauthenticated scans.
• Passive discovery and external attack surface mapping.

An incomplete inventory is the most common reason VM programs fail.

Assessment validates and contextualizes raw findings. A scanner reports a CVE; assessment asks:

• Is it a real exposure or a false positive?
• Is the affected component actually in use and reachable?
• What is the technical severity and business context?

This phase converts noisy scan output into trustworthy, actionable findings.

You will always have more vulnerabilities than capacity to fix. Prioritization ranks them so scarce remediation effort hits the highest risk first.

Good prioritization blends severity (CVSS), exploitation likelihood (EPSS), known active exploitation (KEV), and asset business value/exposure. Patching by CVSS alone wastes effort on theoretical issues while real threats wait.

Remediation closes the gap. Options, in rough order of preference:

• Patch / upgrade the vulnerable software.
• Mitigate / configure (disable feature, restrict access, add WAF rule).
• Accept the risk with formal sign-off when fixing is infeasible.

Remediation is cross-functional: security identifies, but IT/Dev/Ops usually apply the fix.

A ticket marked done is not proof. Verification re-scans or re-tests to confirm the vulnerability is actually gone and no regression occurred.

Without verification, dashboards lie: teams close tickets while the exposure persists. Closing the loop with evidence is what makes the program trustworthy.

Annual or quarterly scanning leaves long blind windows. Modern VM is continuous: new assets, new code, and new CVEs appear daily.

Integrate scanning into CI/CD, image builds, and cloud provisioning so vulnerabilities are caught early and the lifecycle runs constantly rather than in big, stressful batches.

VM only works with clear ownership:

• Security runs scanning, prioritization, and reporting.
• IT / DevOps own asset patching and configuration.
• Application teams fix code-level and dependency issues.
• Risk owners approve exceptions and accept residual risk.

Every finding needs a named owner and a due date, or it stalls.

Measure the program, not just the count of findings:

• Mean time to remediate (MTTR) by severity.
• SLA compliance rate.
• Open vs closed trend over time.
• Coverage (percent of assets scanned).
• Reopen / recurrence rate.

Track aging buckets so old criticals cannot quietly linger.

Not every vulnerability can be fixed promptly. A formal exception process records:

• Why the fix is deferred.
• Compensating controls in place.
• The risk owner who accepts it.
• An expiry date to force re-review.

Exceptions must be time-boxed; an open-ended exception is just an ignored risk.

The lifecycle should improve itself. Use verification and metrics to find systemic issues: recurring CVEs from one library, slow teams, or scan gaps.

Feed that back into discovery (better coverage), prioritization (tuned thresholds), and remediation (automation, golden images). VM maturity is measured by how fast and reliably the loop turns.

Confirm the purpose of the final phase.

The VM lifecycle is a continuous loop: discover assets and weaknesses, assess and validate them, prioritize by real risk, remediate via patch/mitigate/accept, and verify the fix held. Clear ownership, SLAs, metrics, and time-boxed exceptions keep it honest.

Next we drill into the foundation of discovery: scanning and building an accurate asset inventory.