Thousands of new vulnerabilities are published every month. No company can close them all immediately. Vulnerability management therefore answers one question above all: which flaws must be closed first?
The process
First, an inventory of systems and software, including internet-facing systems (attack surface management) and libraries used (SBOM). Second, detecting flaws through vendor advisories, scanners and dependency checks. Third, prioritisation. Fourth, remediation within set deadlines. Fifth, verifying that the fix works.
Prioritisation beyond CVSS
The CVSS score describes a flaw’s theoretical severity. For prioritisation, what counts most is whether it is actually exploited and whether the affected system is reachable. The US agency CISA’s Known Exploited Vulnerabilities catalogue lists actively exploited flaws; the Exploit Prediction Scoring System (EPSS) estimates the likelihood of exploitation. A medium flaw in an internet-facing system that is actively exploited is more urgent than a critical flaw in an isolated test system.
Deadlines and ownership
Deadlines by risk class work well: actively exploited flaws in reachable systems within days, other critical flaws within weeks, the rest in the regular maintenance window. Every flaw needs an owner, and exceptions are justified and time-limited.
Regulatory link
The Cyber Resilience Act requires manufacturers of digital products to handle vulnerabilities throughout the support period and, since September 2026, to report actively exploited flaws to ENISA. Insurers check patch status before offering cyber insurance.