A managed vulnerability program from discovery to verified closure

A vulnerability assessment is a point-in-time scan and review that lists known weaknesses. A penetration test is manual, goal-driven work in which a tester exploits and chains weaknesses to show what an attacker could reach. Vulnerability management is the continuing program around both: asset inventory, regular scanning, prioritization, remediation tracking and verification of fixes. Most organizations need the program running all year, with penetration testing at intervals to find what scanners cannot.

CVSS base score is one input, and a weak one when used alone. Priority combines four questions. Is the flaw being exploited, as shown by the CISA Known Exploited Vulnerabilities catalog and by threat intelligence? How likely is exploitation in the near term, as estimated by EPSS? Is the asset reachable from the internet or a low-trust network? What does the asset hold or control? A medium-severity flaw on an exposed identity system can outrank a critical one on an isolated test server.

Remediation belongs to the system owner, and the program makes that ownership explicit. Each finding is routed to a named team with a remediation target agreed by asset class and severity, and overdue items escalate to a defined manager. We supply fix guidance, compensating controls where a patch cannot be applied, and exception records with an expiry date. If your IT team lacks capacity, patching can be carried out by our managed IT services team under your change process.

A ticket marked done is a claim. Closure is recorded only after the specific finding is retested: a targeted rescan for scanner-detected issues, or manual retesting for findings that were validated by hand. Verification also checks that the fix reached every affected instance, including cloned machines, container images and build templates, because flaws often return from an unpatched template. Reopened findings are tracked separately, so recurring causes such as a broken patch pipeline become visible.

Frequency follows the asset class and how fast it changes. Internet-facing systems warrant the most frequent external scanning, plus discovery of new hosts and services. Servers and network devices follow a regular authenticated cycle. Endpoints are best covered by agents that report continuously. Cloud accounts are checked through provider APIs as configuration changes. Applications are scanned in the release pipeline. Fragile or OT systems may need passive methods and maintenance windows. The schedule is set per class during onboarding and written into the program.