Vulnerability Management
Explain various activities associated with vulnerability management
What you will learn
- Name the sources of vulnerability discovery and what distinguishes each.
- Explain how priorities are set and why a score alone is not enough.
- Separate false positives from false negatives and know which is graver.
- Know the remediation options when patching is impossible, and the role of a documented exception.
Vulnerability management never ends, because vulnerabilities never end. Its hardest part is not discovery — a scan hands you thousands of findings at a keystroke — but the decision: which is fixed first with limited resources? And the answer does not come from a severity score alone.
The cycle
Identification
Automated scanning, threat intelligence feeds, vendor bulletins, penetration testing, and bug bounty programmes.
Analysis and prioritisation
The score, then whether it is actually exploitable, then the asset's criticality, then its exposure.
Remediation
Patch, compensating control, segmentation, a documented exception, or decommissioning.
Validation
Rescanning to confirm the fix worked. The step that gets skipped, leaving the vulnerability closed only in the register.
Reporting
To management by trend, not count: are we improving, and how long does a critical stay open?
Terms
| CVE | A common public identifier for a specific vulnerability. |
|---|---|
| CVSS | A scoring system giving a vulnerability a severity rating. An input to the decision, not the decision. |
| False positive | The scanner reports a flaw that is not there. Its cost is wasted time and eroded trust. |
| False negative | A flaw that exists and is not reported. Far graver: you believe you are clean and you are not. |
| Exception / exemption | A documented decision not to remediate for an accepted reason, with an owner, an expiry and a review. Not "we ignored it". |
The highest score is not always the priority
A 9.8 on an internal test server with no internet exposure and no data is less urgent than a 7.5 on a public server holding customer records with a published exploit. Priority = score × exploitability × asset criticality × exposure. Any option ranking by score alone is incomplete.
Real-world example: a thousand findings and a week
A scan returns 1,240 findings, 84 of them critical. The team can fix about thirty this week. Ranking does not start with the score: first, what is internet-exposed with a published exploit — eight items, done today. Then what touches systems holding classified data — fourteen. Then the rest. Six critical findings on a legacy system that cannot be patched are recorded as a documented exception with an owner and an expiry, with network segmentation around it as a compensating control. Note the outcome is not "we fixed everything critical" but "we fixed what can actually be exploited".
What matters on the exam
- Priority is not the score alone. Read exposure, asset criticality, and whether a public exploit exists.
- A false negative is graver than a false positive: the first gives false assurance, the second wastes time.
- Rescanning after remediation is mandatory. "Patched" without verification is not closed.
- An exception is a documented decision with an owner and an expiry. What separates it from neglect is the documentation — just as with risk acceptance.
Quick check
Answer in your head first, then reveal.
Which is worse: a false positive or a false negative? Why?Reveal the answer
The false negative. A false positive costs time and a needless investigation; a false negative leaves a real flaw open and persuades you it is not there.
A critical vulnerability on a system that cannot be patched. What are the options?Reveal the answer
A compensating control (isolation, segmentation, restricted access), decommissioning the system, or a documented exception with an owner, an expiry and a review. Not leaving it undecided.
Why is patching not enough to close an item in the vulnerability register?Reveal the answer
Because a patch can fail, apply partially, or be reverted on redeployment. Rescanning is what proves the flaw is actually gone, not merely closed in the register.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.