Vulnerability management (VM) is the ongoing lifecycle of discovering, prioritizing, assigning, remediating, and verifying vulnerabilities across an organization's assets — applications, infrastructure, and cloud. Mature VM programs run on dedicated platforms that ingest scanner output, deduplicate it, score risk, and track remediation SLAs.
The lifecycle stages
- Discover: scanners find issues across asset classes.
- Prioritize: scoring blends severity, exploitability, and business context.
- Assign & remediate: findings route to owners with deadlines.
- Verify & report: fixes confirmed, posture reported over time.
The garbage-in problem
Every downstream stage inherits the quality of discovery. If scanning coverage is partial and drifting, prioritization confidently ranks an incomplete picture, and SLA reports describe a fraction of reality. VM platforms rarely control coverage — they assume it.
