Vulnerability Management

Over the past few months, I've been refining how I approach vulnerability management. It's not just about finding holes it's also about aligning with frameworks like NIST SP 800-40 and CIS Control 7 to create a repeatable, risk-driven strategy.

In this post, I'll walk through six key parts of a solid vulnerability management program—mapped loosely to CIS Control 7 and guided by operational guidance from NIST SP 800-40 Rev. 3.

1. Asset Inventory: Know What You Own (CIS 1 + CIS 7.1)

Everything starts with an up-to-date, dynamic inventory. According to NIST SP 800-40, maintaining awareness of what assets are in play is step zero. Without this, you can't assess exposure or prioritize action.

Tactics:

Use tools like ServiceNow, ManageEngine, or CMDB integrations in EDR platforms.
Stay tight with helpdesk/sysadmin teams to track laptops, desktops, and servers in motion.

2. Continuous Scanning and Discovery (CIS 7.2)

NIST emphasizes automated vulnerability scanning as the engine of modern vuln management. Your scanners should run regularly and integrate with inventory systems to detect changes and exposure.

Tools:

Commercial: Tenable.io, Qualys VMDR, Rapid7 InsightVM
Open-Source: OpenVAS, Nikto

3. Risk-Based Prioritization (NIST + CIS 7.3, 7.4)

Not all vulns are created equal. NIST encourages risk-scoring and contextual prioritization rather than CVSS-only thinking. Combine severity with exploitability, asset criticality, and business context.

Factors to Consider:

CVSS + EPSS for exploit likelihood
Criticality of the asset (DMZs, domain controllers, etc.)
Business impact and uptime requirements
Real-world threat intelligence (CISA KEV list, etc.)

4. Patch Management & Mitigation (CIS 7.5)

Patching is the "action" step. According to NIST SP 800-40, enterprise patch management should be timely, automated where possible, and documented.

Tools for Patching:

Workstations: PDQ Deploy, MECM (SCCM), Intune
Servers: WSUS, Red Hat Satellite, Ansible

When patching isn't feasible, documented mitigations (like firewall rules or feature disablement) are acceptable stopgaps.

5. Operational Coordination

Vuln management isn't just tools—it's cross-team communication.

Coordinate with sysadmins on server maintenance windows.
Work closely with desktop teams on software version control.
Track and triage new assets with onboarding processes.

6. Building Toward Maturity

Using the NIST Cybersecurity Framework (CSF) maturity lens, these practices push you toward Tier 3 or higher. It's about making vulnerability management institutionalized—baked into workflows, not just reactive sprints.

Final Thoughts: It's Art + Science

The science is in scanning, data, and patching. The art is in deciding what matters, knowing your environment, and balancing security with business ops.

Frameworks like NIST and CIS give structure—but ultimately, vulnerability management is a human process with technical tooling. Get the fundamentals right, and you'll make your systems safer without burning out your team or disrupting the business.