Vulnerability management is the continuous process of identifying, evaluating, prioritizing, remediating, and reporting on security vulnerabilities across an organization’s systems, applications, and infrastructure. It is one of the foundational practices of cybersecurity, because unpatched and misconfigured systems remain among the most common ways attackers gain initial access.
The vulnerability management lifecycle generally follows a repeating cycle: discovering and inventorying assets, scanning them for vulnerabilities, assessing and prioritizing findings based on severity and business risk, remediating or mitigating them, verifying that fixes were successful, and reporting results to stakeholders. Unlike a one-time audit, vulnerability management is ongoing, since new vulnerabilities are disclosed daily and environments change constantly. Many organizations are now extending vulnerability management into exposure management, which addresses misconfigurations, identity weaknesses, and cloud exposures alongside traditional software vulnerabilities.