Why vulnerability management is more than vulnerability scanning

Buying a scanner is straightforward. Running a process that reliably reduces exposure is not, and the difference is rarely technical.

Coverage before depth

A scan that covers seventy per cent of the estate produces a confident report about the wrong thing. Before tuning detection depth, establish what exists: an asset inventory that includes cloud workloads, remote endpoints, appliances and anything a supplier manages on your behalf. Assets nobody scans are not low risk — they are unmeasured.

Severity is not priority

CVSS describes the characteristics of a vulnerability in the abstract. It does not know whether the affected host is internet-facing, whether the vulnerable component is loaded, whether compensating controls exist, or whether the system holds anything worth taking.

Prioritisation needs local context layered on top: exposure, exploit availability, business criticality. A medium-severity issue on an internet-facing system with a public exploit outranks a critical on an isolated internal host, and a process that cannot express that will spend its effort in the wrong place.

Ownership is the bottleneck

Most programmes do not fail at detection. They fail at the point where a finding needs an owner, a change window and a decision. A finding with no named owner will not be fixed, regardless of how it is scored.

The practical fix is unglamorous: map assets to owning teams, route findings into the systems those teams already work in, and agree remediation timeframes per severity in advance so that each finding does not become a negotiation.

Closing the loop

Verification matters. A finding marked resolved without a rescan is an assumption. So does exception handling — some things genuinely cannot be patched, and those need a recorded decision, a compensating control and a review date rather than silence.

Measuring the right thing

Counting open vulnerabilities rewards suppressing findings. Better questions: how long does it take to remediate by severity, what proportion of the estate is actually covered, and how many exceptions are past their review date. Those describe whether the process works.