Vulnerability Management – Requirements, Scoping & Target Setting

This post (Part 2a of a series) explains the WHAT and WHY of vulnerability management, focusing on requirements and scoping, target setting, risk-based prioritization, SLAs, and metrics/reporting. It advocates Risk-Based Vulnerability Management by combining impact and likelihood (informed by sources like CISA KEV, NIST LEV, and EPSS), contextualizing severity with CVSS v4 environmental metrics, and factoring exposure, controls, dependencies, and user risk. The article provides guidance for setting remediation timelines aligned to risk appetite, establishing KPIs and management/operational views, and accelerating safe patching through automation—encouraging a pragmatic, incremental start with continuous improvement.