Vulnerability management is a continuous six-stage loop — discover assets, scan them, prioritize findings by real-world risk, remediate, verify the fix, and report — that repeats indefinitely rather than running once. With more than 40,000 CVEs published in 2024 alone, no organization can patch everything, so the entire discipline hinges on prioritization: fixing the small fraction of vulnerabilities that are actually exposed and actually being exploited before attackers reach them. The measurable goal is not zero vulnerabilities; it is a falling Mean Time to Remediate (MTTR) on the risks that matter most.
That's the summary an AI Overview will give you. What it can't show you is the shape of the loop, the exact order operations happen in, or the decision logic that separates a CVSS 9.8 you can safely schedule from a CVSS 7.5 you must patch tonight. Below is the lifecycle as an animated flow, a prioritization decision path, a copy-ready program checklist, and the SLA numbers real teams run — the concrete assets a text summary flattens away.
Understanding Vulnerabilities
What Is a CVE?
CVE (Common Vulnerabilities and Exposures) is a standardized identifier for publicly known security vulnerabilities.
CVE format: CVE-YYYY-NNNNN
- YYYY: Year of assignment
- NNNNN: Sequential number
Example: CVE-2021-44228 (Log4Shell)
CVE Databases
📚 NVD vs MITRE CVE Differences: Understanding the CVE ecosystem.
| Database | Role | Content |
|---|---|---|
| MITRE CVE | CVE ID assignment | Basic descriptions |
| NVD | Enrichment | CVSS scores, CPE, references |
| Vendor advisories | Patches | Fix information |
📚 NVD Update Frequency: How long until CVEs are enriched.
Finding Relevant CVEs
📚 Finding CVEs Affecting Your Systems: Systematic CVE discovery.
Methods:
- Vulnerability scanners (Qualys, Tenable, Rapid7)
- Software composition analysis (SCA)
- Vendor security bulletins
- NVD/CVE database searches
- Security mailing lists
CVSS Scoring
CVSS (Common Vulnerability Scoring System) provides standardized severity ratings.
📚 CVSS Scoring System Explained: Deep dive into CVSS metrics.
CVSS 3.1 Score Ranges
| Score | Severity | Typical Response |
|---|---|---|
| 0.0 | None | Informational |
| 0.1-3.9 | Low | Schedule remediation |
| 4.0-6.9 | Medium | Remediate within 30 days |
| 7.0-8.9 | High | Remediate within 7 days |
| 9.0-10.0 | Critical | Immediate response |
CVSS Metric Groups
Base Metrics (inherent characteristics):
- Attack Vector (Network, Adjacent, Local, Physical)
- Attack Complexity (Low, High)
- Privileges Required (None, Low, High)
- User Interaction (None, Required)
- Scope (Unchanged, Changed)
- Impact (Confidentiality, Integrity, Availability)
Temporal Metrics (change over time):
- Exploit Code Maturity
- Remediation Level
- Report Confidence
Environmental Metrics (organization-specific):
- Modified Base Metrics
- Security Requirements (CIA)
Patch Prioritization
CVSS alone isn't sufficient for prioritization—context matters. The single most useful triage question isn't "how high is the score?" but "is anyone actually exploiting this, and can they reach my systems?" A CVSS 9.8 on an isolated internal appliance with no public exploit can wait for the next maintenance window; a CVSS 7.5 on an internet-facing server that appears in CISA's KEV catalog should be patched tonight. The decision path below shows that logic in the order a triage analyst actually applies it.
📚 Prioritizing Which CVEs to Patch First: Risk-based prioritization strategies.
Prioritization Factors
| Factor | Consideration |
|---|---|
| CVSS score | Baseline severity |
| Exploitability | Is exploit code available? |
| Active exploitation | Is it being used in attacks? |
| Asset criticality | Business impact of affected system |
| Exposure | Internet-facing vs internal |
| Compensating controls | Mitigations in place |
SSVC: Stakeholder-Specific Vulnerability Categorization
CISA's SSVC framework provides decision-tree prioritization:
- Track: Remediate within normal cycles
- Track*: Closer monitoring required
- Attend: Remediate sooner than normal
- Act: Immediate action required
Patch Timeline Expectations
📚 CVE Patch Timeline: From disclosure to patch availability.
Typical timelines:
- Critical vendor response: 24-72 hours
- Standard patch release: 30-90 days
- Coordinated disclosure: 90 days typical
Vulnerability Management Workflow
📚 Vulnerability Management Workflow: End-to-end process guide.
1. Asset Discovery
You can't protect what you don't know about:
- Network scanning
- Agent-based discovery
- CMDB integration
- Cloud API inventory
2. Vulnerability Scanning
Regular scanning identifies vulnerabilities:
- Frequency: Weekly to continuous
- Coverage: All assets
- Authentication: Credentialed scans for accuracy
- Scope: Network, web applications, containers
3. Prioritization
Apply risk-based prioritization:
- Filter by exploitability and exposure
- Weigh asset criticality
- Consider compensating controls
- Focus on actionable findings
4. Remediation
Execute patches and fixes:
- Emergency patches for critical/exploited
- Scheduled maintenance windows
- Change management process
- Validation testing
5. Verification
Confirm remediation success:
- Re-scan affected systems
- Verify patch installation
- Test application functionality
- Close vulnerability records
6. Reporting
Track metrics and communicate:
- Mean time to remediate (MTTR)
- Vulnerability counts by severity
- Remediation SLA compliance
- Risk reduction over time
Tools and Resources
| Tool | Purpose |
|---|---|
| CVE Lookup | Search and analyze CVE details |
Vulnerability Management Maturity
Level 1: Ad Hoc
- Reactive patching
- No formal process
- Limited visibility
Level 2: Defined
- Regular scanning schedule
- Basic prioritization
- Manual tracking
Level 3: Managed
- Risk-based prioritization
- SLA tracking
- Automated scanning
Level 4: Optimized
- Continuous monitoring
- Predictive analysis
- Integration with threat intel
- Automated remediation
Best Practices
- Scan continuously, not just quarterly
- Prioritize ruthlessly—you can't patch everything immediately
- Track exploited vulnerabilities (CISA KEV catalog)
- Measure and improve remediation times
- Automate where possible
- Communicate risk in business terms
Program Starter Checklist
If you're standing up or auditing a program, work down this list. It maps directly to the six-stage loop above — each item is something you should be able to answer "yes, and here's the evidence" to.
Discover
- A single source of truth for assets (CMDB or inventory) refreshed at least weekly
- Cloud accounts inventoried via provider APIs, not spreadsheets
- Ownership assigned for every asset (who patches it?)
Scan
- Credentialed scans on all in-scope hosts (uncredentialed scans miss most findings)
- Web apps and containers scanned, not just network hosts
- Scan cadence at least weekly; continuous for internet-facing assets
Prioritize
- CISA KEV catalog cross-referenced automatically against your findings
- Internet-facing exposure flagged as a first-class prioritization factor
- Documented risk-based SLAs by severity (not "patch everything Critical")
Remediate
- Emergency/out-of-band patch path that bypasses the normal change queue
- Compensating controls documented when a patch can't ship immediately
- Change management integrated, not bypassed
Verify
- Every remediation is confirmed by a re-scan, not a checkbox
- Vulnerability records only close on verified evidence
Report
- MTTR tracked by severity and trending down
- SLA compliance rate reported to leadership in business terms
- Overdue-high-severity backlog visible and shrinking
SLA Reference Table
| Severity (CVSS) | Standard SLA | Escalation trigger |
|---|---|---|
| Critical (9.0–10.0) | 24–72 hours | Immediate if in KEV or actively exploited |
| High (7.0–8.9) | 7 days | Move to Critical if internet-facing + exploit exists |
| Medium (4.0–6.9) | 30 days | Move to High if exposure increases |
| Low (0.1–3.9) | Scheduled cycle / accept + track | Re-evaluate on new exploit intel |
| Which do I drop everything for? | KEV entries + exploited internet-facing | These jump the queue regardless of raw CVSS |
Conclusion
Effective vulnerability management balances comprehensive coverage with practical prioritization. Focus on:
- Visibility: Know your assets and their vulnerabilities
- Prioritization: Use risk-based approaches, not just CVSS
- Speed: Reduce mean time to remediate
- Measurement: Track metrics and demonstrate improvement
The goal isn't zero vulnerabilities—it's managing risk effectively with limited resources. A mature vulnerability management program reduces your attack surface systematically while enabling business operations.