Vulnerability Management Lifecycle

The VM Lifecycle represents the process and series of critical stages to identify and remediate vulnerabilities/weakness to attacks and exploitation of discovered findings.


Detect and interrogate system assets

  • Devices, platforms, applications

Identify all assets

  • Identify assets that need to be monitored

  • The intent is to ensure no vulnerable devices are overlooked

Prioritize Assets

Determines the priority of discovered assets

  • What assets are most business-critical?

  • What assets require immediate attention?

  • Helps focus resources

Patching all assets at once is likely not feasible. Ensure to collaborate with asset owners and stakeholders to determine asset priorities


Determines if a vulnerability exists in the system

  • Compares assets to known vulnerabilities

  • Determine Risk score (CVSS, VRT, etc)


Presents assets and vulnerabilities in a form to view findings

  • Compile discovery with identified vulnerabilities

  • Usually categorized by priority, location, etc

  • Tailor reports for various audiences


Takes action on a vulnerability

  • Apply patches

  • Initiate compensating controls

  • Accept the vulnerability/risk


Verifies that a remediation was successful or effective

  • Was vulnerability resolved?

  • Is further action needed?

VM Lifecycle Challenges

Incomplete asset information - Effective discovery requires both asset identification and the information about the contents of each asset

Incomplete asset lists - Out-of-date asset lists and mixed data sources can prevent discovery from providing complete asset accountability for a thorough risk evaluation

Overwhelming scan data - Prioritization helps target efforts for the most critical assets from the most serious threats

Organizational communication - Frequent communication, reports, system dashboards, and notifications help keep teams informed for required patching/updates

Vulnerability Identification - Vulnerability data must be up to data and relevant from authoritative sources

Timely Remediation - Efforts must be timely, organized, and effective with specific assignments and accountability

Process Tracking - Verification helps assure that remediation is successful with no new vulnerabilities exposed

Last updated