Also known as: patch management · VM program
Vulnerability management is the ongoing process of identifying, prioritising, remediating, and verifying fixes for security weaknesses across an organisation's systems and software.
The defining constraint is that no organisation can patch everything immediately, so the discipline is fundamentally about prioritisation. Effective programmes combine severity with exploitation likelihood and asset context — a critical flaw on an isolated test box outranks nothing.
The unglamorous prerequisite is asset inventory. Scanning cannot find vulnerabilities on systems nobody knows exist, and forgotten infrastructure is disproportionately represented in real breaches.
CVE
CVE (Common Vulnerabilities and Exposures) is a public catalogue that assigns a unique identifier, such as CVE-2026-31337, to each publicly disclosed software vulnerability so that everyone can refer to the same flaw unambiguously.
CVSS
CVSS (Common Vulnerability Scoring System) is an open standard that scores the technical severity of a vulnerability from 0.0 to 10.0, based on factors such as attack complexity, required privileges, and impact on confidentiality, integrity, and availability.
EPSS
EPSS (Exploit Prediction Scoring System) estimates the probability that a given vulnerability will be exploited in the wild within the next 30 days, expressed as a percentage between 0 and 100.
KEV Catalog
The KEV (Known Exploited Vulnerabilities) catalog is a list maintained by the US Cybersecurity and Infrastructure Security Agency of vulnerabilities with confirmed evidence of active exploitation in the wild.
SBOM
An SBOM (Software Bill of Materials) is a formal, machine-readable inventory of every component and dependency contained in a piece of software, including version numbers and licence information.
N-Day
An n-day is a vulnerability that has already been publicly disclosed and patched, but remains exploitable on systems that have not yet applied the update.