Vulnerability management

Vulnerability management is not a scan; it is a process that never ends. A typical cycle looks like this:

1. Discover: keep an inventory of assets and scan them for known vulnerabilities and misconfigurations.
2. Prioritize: rank findings by severity, exposure, asset importance and evidence of active exploitation.
3. Remediate: patch, change a configuration, or apply a compensating control when a fix is not possible yet.
4. Verify: rescan to confirm the fix worked.
5. Report: track trends such as time to remediate and the number of overdue critical findings.

The hardest part is usually not finding vulnerabilities but deciding what to fix first, since large environments can have tens of thousands of open findings at any moment.

Example

A weekly scan reports 12,000 vulnerabilities. The team filters for flaws listed in CISA's Known Exploited Vulnerabilities catalog on internet-facing systems, which leaves 14 findings across three servers. Those are fixed within 48 hours, while the rest go into the normal patch cycle.

Why it matters for a SOC analyst

Vulnerability data turns alerts into context: an exploit attempt against a server that is already patched is noise, while the same attempt against an unpatched one is an incident. When a critical vulnerability makes the news, the SOC is often asked "are we exposed and were we hit?", and the answer depends on how good the inventory and scan data are.