Vulnerability Management 101.

A vulnerability is a weakness that an attacker can use. Publicly disclosed flaws in software and hardware usually get a CVE ID, so everyone can refer to the same flaw. Vulnerability management is the routine that keeps track of them in your own systems. For the short definition, see the vulnerability management glossary entry.

The cycle, also called the lifecycle, has six steps: know your assets, scan, rank, fix, verify and report. Then it starts again, because the next batch of flaws is already coming.

You cannot fix a system you do not know about. Build a list of servers, laptops, cloud services, applications and internet-facing assets, and note who owns each one.

The weak point is usually the forgotten asset, such as an old test server or an account in a cloud service that nobody tracks. Looking at your company from the outside, the way an attacker does, helps find them. See EASM 101.

A scanner checks your systems for known flaws, missing patches and risky settings. Scan on a schedule, and again after big changes. An authenticated scan signs in to the system and sees installed software. An unauthenticated scan sees only what a stranger sees. Scans from the inside show what an intruder could reach. Scans from the outside show what the internet can reach.

A scan result is a list of possibilities, not a list of facts. Some findings will be wrong or will not apply to how you use the system.

A scan can return thousands of findings. You cannot fix them all at once, so ranking is the core skill. Three public sources help.

• The CVSS base score published with a flaw rates its general severity. It does not know your environment unless you add the environmental metrics yourself.
• EPSS, published by FIRST, estimates how likely a flaw is to be exploited in the next 30 days.
• The CISA Known Exploited Vulnerabilities catalog lists flaws that attackers are already using.

Start with flaws on the CISA list, then ones that sit on internet-facing systems, then the rest by score. Read more on vulnerability prioritization.

A worked example

CVE-2026-76519 is a CVSS 9.8 file write flaw in Cisco Secure Email Gateway. CISA added it to the catalog on 14 October 2026. A team with an affected gateway facing the internet would put it first, whatever else the scan found. See the CVE-2026-76519 page.

The usual fix is a patch. When a patch is not possible yet, reduce the risk: turn off the feature, block access with a firewall rule or limit who can reach the system.

Agree on target times for each risk level, and who is responsible for each system. CISA sets a due date for US federal agencies when it adds a flaw to its catalog. For CVE-2026-76519 that date was 17 October 2026, three days after the listing, and other teams can use such dates as a guide. A flaw that is being exploited should be fixed in days, not in the next quarterly window.

After a fix, scan again to prove it worked. Patches fail, and systems get rolled back.

Then report to the people who decide. Useful figures are the mean time to fix critical findings, how many exploited flaws are still open and which teams are behind. Keep the report to one page and show the trend from month to month.

Brandefense vulnerability intelligence helps with the ranking step by showing which flaws are being exploited.