Vulnerability Management – common understanding and language enable teamwork

This article introduces a common vocabulary and framework for vulnerability management, defining vulnerabilities, findings, and risks; outlining discovery/disclosure, advisories, exploitation, detection and scanning, prioritization with CVSS and KEV, and response options (patching, mitigation, acceptance); mapping interfaces with asset, patch, change, risk, and incident management; and highlighting regulatory and standards drivers, using Log4Shell (CVE-2021-44228) as an illustrative example.