Key takeaway
Give each finding an owner, due date and appropriate verification. Distinguish risk acceptance from remediation, and record residual risk and the next review.
1. Assess
Authorize discovery across assets, networks, applications and endpoints within an agreed scope and safe timing. Check inventory, scan credentials and tool limitations. Validate asset and version applicability, actual reachability and duplicate signals. Correlate endpoint detection and response (EDR) telemetry with inventory and vulnerability scans; having EDR does not establish a full vulnerability scanner. Link each finding to its owner, service dependencies and recent changes.
2. Evaluate and prioritize
Evaluate technical severity alongside exploitation evidence, reachability and business consequences. In the Common Vulnerability Scoring System (CVSS) v4.0, Base reflects technical flaw characteristics, Threat changing exploitation information, and Environmental the local environment. A Base score alone is not business risk; a low score does not mean harmlessness on a sensitive system. Consider data, service, financial and recovery impact, and record the decision and residual-risk owner.
3. Act
Choose an approved patch, configuration change, unnecessary-service shutdown or temporary network restriction suited to the finding. Assign an owner, due date and verification criteria. Test compatibility and prepare rollback before the change. If remediation is delayed, document a temporary control and time-limited risk-owner acceptance. Risk acceptance and additional monitoring do not remove the flaw; an exception needs expiry and a next review.
4. Reassess
After the change, choose rescans, version, configuration or reachability checks suited to the finding and validate service health. A version change alone does not prove every attack path is closed. If the finding persists or returns, investigate and return work to its owner. Close the record using technical evidence and a residual-risk decision, rather than ticket status alone.
5. Report and improve
Reports should show scope, validated open findings, priorities, owners, due dates, exceptions, completed remediation and verification evidence. Repeated weaknesses may point to root causes in code quality, baseline configuration, inventory or change processes. Track overdue critical findings, time to closure, reopened items and service impact after patching. Use the results to update scan coverage, training, patch windows and automation.
Assessment versus management
Vulnerability assessment examines weaknesses found in a network, application, process or endpoint and estimates their relative importance. Vulnerability management is the broader cycle: inventory, discovery, prioritization, remediation, ownership, reassessment and reporting. Assessment asks “what did we find, and how serious is it?” Management asks “who will do what by when, and how will we verify it?” Both depend on asset visibility and clear responsibility.