Vulnerability management: time is the deciding factor

From scanning to priority

A scan produces thousands of findings. Priority depends on system exposure, exploit availability, active exploitation and the value of the service to the organisation.

Who fixes

The weak point is often the step from finding to fix: it takes system engineers who know the systems, agreed maintenance windows and post-fix verification. Where a fix is not possible, compensating measures such as segmentation or virtual patching.

Measure to improve

1. Mean time to remediate by severity.
2. Percentage of assets covered by scanning.
3. Critical vulnerabilities exposed beyond the agreed threshold.
4. Quarterly trend reported to the board.