From asset inventory to verified remediation: how to prioritize vulnerabilities with CVSS 4.0, EPSS and the CISA KEV catalog, and run patching as routine work.
Vulnerability management is the continuous process of identifying weaknesses in your assets, deciding which ones matter most, fixing or mitigating them, and verifying the result; patch management is the part of that process that deploys vendor updates in a controlled way. Because no organization can patch everything immediately, the core skill is prioritization based on real risk: exposure, active exploitation and business impact, not severity scores alone.
The two terms are often used interchangeably, but they cover different scopes. Vulnerability management starts with knowing what you own, then scanning and assessing, prioritizing, remediating and reporting. Remediation can mean applying a patch, but also changing a configuration, disabling a service, isolating a system or accepting a documented risk.
Patch management, as described by NIST in SP 800-40 Revision 4 (2022), is best treated as routine preventive maintenance rather than an emergency activity. NIST recommends that organizations define maintenance plans for groups of assets, accept that updates will sometimes cause problems, and build processes that make patching regular and predictable instead of exceptional.
You cannot protect what you do not know. The inventory should cover servers, workstations, network and security devices, cloud resources, containers, operational technology where relevant, and the software components running on them. Pay special attention to internet-facing systems: VPN gateways, firewalls, remote access portals, web applications and file transfer servers are frequent entry points.
Scanning should combine several sources:
The Common Vulnerability Scoring System, maintained by FIRST, describes technical severity. Version 4.0 introduced base, threat, environmental and supplemental metric groups, making it clearer that a base score alone does not measure risk in your environment. A long list of "critical" findings sorted only by base score leads to wasted effort.
Better prioritization combines several signals:
This approach is reflected in CISA's Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk", issued in June 2026 for US federal agencies. It replaces BOD 22-01 and BOD 19-02 and bases remediation priorities on public exposure, KEV status, whether exploitation can be automated, and technical impact. It also asks agencies to check whether a system has already been compromised, since patching does not remove an attacker who is already inside. Although it applies only to US federal agencies, it is a useful model for any organization.
Define target remediation times by risk category and document them in a policy approved by management. A sound deployment process includes:
Network and security equipment deserves specific attention. Firewalls, VPN concentrators and management platforms are exposed by design and have been targeted repeatedly; their firmware should follow the same disciplined process as servers, with close monitoring of vendor security advisories.
A ticket closed is not a vulnerability fixed. Rescan after remediation to confirm the result, and track exceptions formally: each accepted risk needs an owner, a justification, compensating controls and an expiry date. End-of-life systems that no longer receive updates should appear clearly in risk reports, with a replacement plan.
Useful indicators include the time to remediate by risk category, the share of internet-facing assets with known exploited vulnerabilities, scan coverage of the inventory, and the number of expired exceptions. They show whether the process works, rather than simply counting findings.
Vulnerability management combines technical analysis with risk governance. Analysts who run scanners, interpret findings and prioritize remediation can prepare with CompTIA CySA+, and network defenders can strengthen their hardening and monitoring skills with EC-Council Certified Network Defender (CND). Managers who need to integrate vulnerability management into an information security risk process can follow the PECB ISO/IEC 27005 Risk Manager course, delivered by Securevalley Training as a PECB Authorized Silver Partner.
Effective vulnerability management is less about scanning more and more about deciding better. A reliable inventory, prioritization based on exploitation and exposure, routine patching with clear exceptions, and verification of results make the process sustainable. Frameworks such as NIST SP 800-40 and CISA's risk-based approach provide a solid structure to build on.