Vulnerability Management

The Vulnerability Management Lifecycle

• Discover. Inventory assets and scan them for weaknesses, from source code and dependencies to containers and cloud configuration.
• Prioritize. Rank findings using severity, exploitability, reachability and business impact.
• Remediate. Patch, upgrade, reconfigure or apply a compensating control.
• Verify. Confirm the fix closed the issue and did not introduce a new one.
• Report. Track progress with metrics such as mean time to remediate and SLA compliance.

Why Prioritization Is the Hard Part

Discovery is largely automated, and most organizations find far more vulnerabilities than they can fix. The real work is deciding what to fix first. Ranking by severity alone tends to produce a long list of "critical" items, many of which are unreachable or not exploitable in context. Mature programs combine signals such as CVSS, EPSS, the CISA KEV catalog and reachability to focus effort where risk is real.

Common Vulnerability Management Metrics

• Mean time to remediate. How long findings stay open on average.
• SLA compliance. The share of findings fixed within the agreed window for their priority.
• Backlog trend. Whether open risk is growing or shrinking over time.
• Coverage. How much of the environment is actually being scanned.

Raw vulnerability counts are a weak metric on their own, because they rise with every new scanner and say little about real exposure.

How Nullify Approaches Vulnerability Management

Nullify keeps one prioritized backlog across code vulnerabilities, leaked secrets, cloud misconfigurations, supply chain risks and validated pentest findings, with each item scored from 0 to 100 on severity, exploitability, reachability and business impact. Work is organized into campaigns, owners come from CODEOWNERS and commit history, and stalled fixes are escalated in Slack with the risk and SLA stated. See how Nullify runs the security program.