Vulnerability Management

Traditional vulnerability management drowned teams in high-severity findings with no way to sequence them. Risk-based vulnerability management (RBVM) fixed the ordering by adding exploit-likelihood and threat context.

A modern programme ingests findings from scanners and external discovery, scores them by exploitability, routes fixes to owners, and measures time-to-remediate for what matters.

Vulnerability management is a continuous cycle rather than a task with an end. The classic stages are discovery, where scanning and testing find weaknesses; prioritisation, where findings are ranked by risk; remediation, where they are patched or mitigated; and verification, where fixes are confirmed. The cycle then repeats, because new vulnerabilities and new assets appear constantly.

The defining challenge of modern vulnerability management is volume. Tens of thousands of CVEs are disclosed annually, and scanners routinely return thousands of findings, the majority rated high or critical by CVSS. No team can fix them all, so the discipline lives or dies on prioritisation: distinguishing the small percentage of vulnerabilities that attackers actually exploit from the large majority that they never touch.

This is why the field has shifted toward risk-based vulnerability management, which ranks findings using real-world exploitation signals such as EPSS probability, CISA KEV status and threat-actor activity, rather than severity alone. A CVSS-only queue tells a team that almost everything is critical, which is the same as telling them nothing. Exploitation-led prioritisation makes the queue actionable.

Vulnerability management also depends on process and ownership as much as tooling. A finding is only resolved when someone patches or mitigates it, which requires clear ownership, integration with ticketing and change processes, and agreed timelines by severity. Programmes that treat vulnerability management as purely a scanning exercise, without the operational follow-through, accumulate findings faster than they close them.

Effective programmes tie remediation timelines to risk through service-level agreements: the most dangerous, actively exploited vulnerabilities are fixed within days, while lower-risk findings follow longer schedules. Asset criticality feeds into this too, because the same vulnerability on an internet-facing payment system warrants faster action than on an isolated internal test machine. This risk-tiered approach keeps the programme focused and makes its expectations measurable.

Vulnerability management relies on a stack of tools, from scanners that discover weaknesses to prioritisation platforms that rank them and ticketing systems that track remediation, but tools alone do not resolve anything. A finding is only closed when an owner patches or mitigates it, which requires clear accountability and integration with change processes. Programmes that invest only in scanning, without the operational follow-through, accumulate findings faster than they close them.

Increasingly, vulnerability management is folded into the broader discipline of exposure management, which widens the lens from software vulnerabilities alone to the full set of exploitable weaknesses across an attack surface, including misconfigurations and exposed assets. The through-line is the same: discover what could be exploited, prioritise by real-world risk, remediate what matters, and verify, continuously, because both the environment and the threat landscape never stop changing.

Precursor is the prioritisation and intelligence layer: it takes your scanner output or declared technology stack and returns a defensible, evidenced queue via the exploitation risk score.