The vulnerability management lifecycle
In short: Vulnerability management is the ongoing process of finding, ranking and fixing security weaknesses. It runs as a cycle: discover, assess, prioritise, remediate, verify and report. Success depends on an accurate asset inventory and clear ownership, not just on the scanning tool.
What vulnerability management is
A vulnerability is a weakness that could be exploited: a missing patch, a default password, an insecure setting or a flaw in custom code. New vulnerabilities are published every day, so finding them once is not enough. Vulnerability management is the repeating process of finding them, deciding which matter most, fixing them and proving they are fixed.
The six stages
| Stage | Key activities | Output |
|---|---|---|
| Discover | Build the asset inventory; run scans, agents and cloud posture checks | Raw findings tied to assets |
| Assess | Remove false positives; check severity and whether the flaw is reachable | Validated findings |
| Prioritise | Rank by exploitability, exposure and asset importance | An ordered work list |
| Remediate | Patch, reconfigure, upgrade, or apply a mitigation; accept risk formally if needed | Changes made |
| Verify | Rescan or retest to confirm the fix worked | Closed findings |
| Report | Track open items, ageing and SLA compliance; show trends | Metrics for owners and management |
Remediation has three main options. Remediate means removing the flaw (for example, patching). Mitigate means reducing the risk when you cannot fix it yet, such as blocking a port or adding monitoring. Accept means formally deciding to live with it, with a named owner and an expiry date for the decision.
Foundations that make it work
- Asset inventory: you cannot scan or patch what you do not know about. Include cloud resources, laptops off the network and network devices.
- Ownership: every asset needs an owner who is responsible for fixing it. Security finds and tracks; system owners fix.
- Policy and SLAs: agree target fix times by severity in advance, so nobody argues about each finding.
- Change management: fixes must go through a sensible, fast approval process.
Common mistakes
- Scanning only some networks, leaving cloud and remote devices blind.
- Sending huge raw scanner reports to system teams with no prioritisation.
- Treating every "critical" as equally urgent instead of weighing exploitation and exposure.
- Closing tickets without rescanning, so fixes that failed are never noticed.
- Letting risk acceptances run forever without review.
Tip: in interviews, describe vulnerability management as a process with owners and metrics, not as "running a scanner". Try a scan in the vulnerability scanning lab.
Practice
What is the difference between remediating and mitigating a vulnerability?
Why is the verify stage important?
Who should normally fix a vulnerability on an application server: security or the system owner?
Key takeaways
- Vulnerability management is a continuous cycle, not a one-off scan.
- Stages: discover, assess, prioritise, remediate, verify, report.
- Options are remediate, mitigate or formally accept with an expiry date.
- An accurate asset inventory and clear owners are essential.
- Always verify fixes before closing findings.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.