Catalog
method#Security#Governance#Observability#Reliability

Vulnerability Management

Continuous process for identifying, assessing and remediating security vulnerabilities in IT systems.

Vulnerability management is a continuous process to identify, assess, prioritize, and remediate security weaknesses across IT assets.
Established
Medium

Classification

  • Medium
  • Technical
  • Organizational
  • Intermediate

Technical context

SIEM (Security Information and Event Management)Ticketing systems (e.g. Jira, ServiceNow)CI/CD pipeline to block critical builds

Principles & goals

Continuous monitoring instead of one-off audits.Risk-based prioritization of remediation tasks.Clear responsibilities and SLAs for fixes.
Run
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Overloading teams with unprioritized findings.
  • Overreliance on automated scanners without validation.
  • Lack of coordination leads to open remediation tickets.
  • Combine automated scans with regular validation.
  • Use risk-based prioritization rather than CVSS-only ordering.
  • Introduce clear SLAs for remediation and escalation paths.

I/O & resources

  • Asset inventory (hosts, applications, cloud resources)
  • Access to scanning tools and credentials
  • Security and business context for prioritization
  • Prioritized vulnerability list with owners
  • Remediation tickets in ticketing system
  • Regular KPI reports for stakeholders

Description

Vulnerability management is a continuous process to identify, assess, prioritize, and remediate security weaknesses across IT assets. The method combines scanning, asset inventories, risk-based prioritization and coordinated remediation workflows. It aims to reduce attack surface, improve patching cadence, and clarify cross-team responsibilities.

✔

  • Reduced attack surface through systematic removal of vulnerabilities.
  • Improved reporting and traceability of security actions.
  • Shorter time-to-fix for critical vulnerabilities.

✖

  • Requires a complete and up-to-date asset inventory.
  • Scans produce false positives that must be validated.
  • Not all vulnerabilities are immediately patchable (legacy systems).

  • Time-to-Fix

    Average time from detection to remediation of a vulnerability.

  • Number of critical open findings

    Current count of open vulnerabilities classified as critical.

  • Remediation rate

    Percentage of remediation tickets closed per period.

Company-wide vulnerability campaign

Quarterly scans, central tracking and a pilot for automatic patches on critical systems.

Team-based remediation workflow

Decentralized execution by teams with central prioritization and reporting to security operations.

Integration with CI/CD pipeline

Vulnerability scans in build stage, blocking critical findings before deployment.

1

Build and categorize asset inventory.

2

Evaluate, pilot and roll out scanning tools.

3

Define prioritization rules (e.g. CVSS + business context).

4

Set up ticketing and reporting integrations.

5

Establish regular reviews and KPI optimization.

⚠️ Technical debt & bottlenecks

  • Old systems without patch path require manual measures.
  • Insufficiently automated validation processes increase effort.
  • Missing ticketing integration causes rework overhead.
Incomplete inventoryLimited remediation capacityManual validation processes
  • Scanning only outside business hours without follow-up.
  • Creating tickets for non-responsible teams without clear ownership.
  • Automatically closing findings after time without review.
  • Incomplete inventory leads to blind spots.
  • Too many false positives reduce team acceptance.
  • Lack of alignment between security and operations delays fixes.
Basic understanding of networks and operating systemsExperience with vulnerability scanners and interpretationProcess and coordination skills for remediation
Complete asset inventoryIntegrations to ticketing and CI/CD systemsAutomated scanning and reporting
  • • Restrictions for production scans (performance, maintenance windows)
  • • Legal or regulatory constraints on data processing
  • • Legacy systems without patch support