Key takeaway
Connect assets, vulnerabilities, threat signals and remediation status. Use CVSS with context; a Base score alone does not represent organizational risk.
What threat and vulnerability management combines
TVM connects assets, vulnerabilities, threat information and remediation in one risk process. Software defects, misconfigurations, weak authentication and exposed services are assessed alongside attacker activity. The objective is to reduce exploitable paths to important business assets and track the result, rather than measuring success by scanning volume alone.
Identify risk and discover coverage
Maintain server, endpoint, application and cloud inventory with owners and criticality. Detect weaknesses through authenticated scans, configuration review and other evidence. Include external exposure, internal access, supplier dependencies and excessive privileges. Track uncovered assets and scan failures as open work; a result set is useful only with an understood view of coverage.
Validate and prioritize vulnerabilities
Validate false positives and version applicability. CVSS Base describes intrinsic severity, not complete business risk. An internet-reachable flaw under active exploitation can demand urgency, but context remains decisive. Document reasons for priority, dates and escalation; new information can reorder work without changing the underlying severity score.
| Input | What it tells you | Decision use |
|---|---|---|
| CVSS Base | Intrinsic vulnerability severity. | Combine with affected configuration and context. |
| KEV / vendor exploitation evidence | Observed exploitation elsewhere. | Prioritize applicable exposed assets; do not infer a local incident. |
| Asset exposure and criticality | Reachable path and business consequence. | Decide urgency with the service owner. |
| Controls and change constraints | Verified protection and treatment dependencies. | Record interim action, owner and reassessment. |
Use threat intelligence in decisions
Match vendor, researcher and government information to actual assets and versions. CISA KEV provides a useful known-exploitation signal. Compare attacker techniques and indicators with internal events; a feed entry does not itself establish an incident. Relevant evidence should connect incident responders and remediation teams to the same risk and affected assets. Absence from KEV does not establish that a vulnerability is safe.
Remediate and mitigate
Assign patches, configuration, MFA and least-privilege changes to owners with a safe change plan. When patching is unavailable, segmentation, IPS, EDR or exposure reduction may provide compensating controls. Verify how the alternative reduces the particular exploit path. Exceptions need a risk owner, expiry and review date, followed by technical verification of treatment. EDR, IPS and segmentation are compensating measures only where validated for the specific path; detection alone does not remove the vulnerability.
Continuous monitoring and automation
Reassess as assets, software and threats change. Automated scans, prioritization, alerts and tickets scale work, while false results and business context need human review. Require evidence and impact validation for AI-assisted analysis. Bound automated remediation with approval, testing and rollback, then track reopened findings and delayed treatments to improve the process.
TVM alongside existing defenses
Firewalls, antivirus and IDS help block or detect attacks; TVM adds systematic discovery and correction of weaknesses alongside them. Prioritize by exploitation and business impact rather than treating every finding equally. Reassess access risk for Zero Trust or adaptive controls, including internal assets. Existing defenses remain part of the program, with threat intelligence helping focus their configuration and investigation.
Reporting and control evidence
Dashboards show coverage, critical risk, remediation time, exceptions and recurring findings. Give technical teams assets and tasks, and management business impact and decisions. Map evidence to applicable PCI DSS, HIPAA or other controls. Separate completed work from residual risk and state assessment dates and coverage so reporting supports assurance without overstating what was assessed.