Vulnerability & Exposure Management

Security teams switch on a scanner, receive forty thousand findings in the first week, and the organisation responds by counting them. The number becomes a target, and the target is met by closing tickets rather than by reducing exposure. A finding on a decommissioned server counts the same as one on the internet-facing VPN concentrator, and a vendor severity score outranks the fact that a working exploit is in use.

Teams then run a thirty-day patch policy they cannot meet, because much of the estate is third-party code, device firmware and managed software they do not build. Exceptions accumulate in email, nobody can say which exposures are reachable from the internet, and the one question that matters during an incident takes days to answer.

Shift the unit of work from the finding to the exposure. Build an asset and identity graph joining scanner output, cloud inventory, endpoint management, directory data and ownership records, so every finding sits on a named system with an owner and business context. Mark what is reachable from the internet, directly or through a single hop, and treat that reachability as a multiplier.

Prioritise on exploitability rather than the severity score (CVSS) alone. EPSS, from FIRST, gives a daily-updated estimate of the chance that a published CVE is exploited within the coming 30 days; CISA's Known Exploited Vulnerabilities (KEV) catalogue lists vulnerabilities with confirmed exploitation; and public exploit code shows how easy an attack would be. A medium finding with a working exploit and an internet path outranks a critical finding on an isolated host.

Set timelines by exposure class. Internet-facing with known exploitation means days; internal with a viable path means weeks; isolated and unexploited follows the scheduled cycle. Where remediation is genuinely blocked, run a time-boxed acceptance with a named owner, a compensating control and a review date, so the exception lives in a system rather than a mailbox.

1. Discovery. Collect assets from cloud APIs, scanner exports, endpoint agents, registries and the configuration database on a cycle short enough to match the rate of change.
2. Correlation. Deduplicate the same weakness reported by several tools, and attach each finding to one asset record with an owner and a service.
3. Exposure scoring. Compute internet reachability, data sensitivity, identity privilege and business criticality, and store the result as context rather than a number alone.
4. Exploitability enrichment. Join EPSS, KEV membership and exploit availability daily, because these move faster than the scan cycle.
5. Prioritisation. Rank by exposure class and exploitability, then publish a work queue per owner rather than the raw finding list.
6. Remediation. Route to the owning team through its existing tracker, with a due date from the exposure class and an acceptance route for blocked items.
7. Verification. Rescan or query the asset to confirm the fix; an unverified ticket close reopens automatically.

• Inventory assembled continuously from APIs, not from a quarterly scan
• Ownership derived from tags and directory data so findings route themselves
• Reachability computed from network and identity policy, not inferred from a subnet label
• Remediation delivered as a pipeline change rather than a hand-patched host

• Restrict acceptance approval to the asset owner plus a risk owner, not the discovering team.
• Record every exception with a compensating control, an expiry and a review date.
• Verify closure by rescan or configuration query rather than by ticket status.
• Alert when an internet-facing asset appears with no owner assigned.
• Scope each integration credential to one system.

• Reachability-aware prioritisation vs. the graph is only as good as its inputs, and stale tags quietly misroute work for months.
• Exploitability signals reduce noise vs. EPSS is a population-level probability that says nothing about your estate, so it weights a decision rather than making it.
• Fewer, better findings vs. the raw count falls, which looks like reduced diligence to anyone measuring volume.
• Exposure-based deadlines are defensible vs. they are also negotiable, and every exception costs reviewer time.

• Deduplicate before you prioritise. One vulnerable OpenSSL version may be reported by the scanner, the registry and the endpoint tool. Without correlation the queue is inflated threefold and credibility is lost immediately.
• Internet exposure is a claim to verify. Confirm it from outside, not from a subnet label or a firewall rule nobody has read since the migration.
• Ephemeral assets need a short cycle. A container that lives four hours never appears in a weekly scan. Pull image findings from the registry and reconcile on deploy.
• Exceptions are a control, not a failure. A time-boxed acceptance with an owner, a compensating control and a review date is auditable. An email saying "accepted risk" is not.

A logistics company scans twelve thousand servers and eight hundred cloud workloads weekly and produces about thirty thousand findings. The security team of four cannot triage them, so it forwards the critical and high list to infrastructure, which fixes what it can and ignores the rest. Two thirds of the estate is third-party software and device firmware, so the thirty-day policy is unachievable by design and everyone knows it.

The team stops reporting counts. It builds a graph joining cloud inventory, the scanner, endpoint data and the directory, then assigns each asset an owner from its tags. It computes internet reachability and joins EPSS and KEV daily. The work queue drops to under four hundred items. Roughly sixty are internet-facing with known exploitation, and those are fixed within a week, including an edge device that had been exposed for eleven months with a medium score.

The remainder is scheduled by class. Exceptions for device firmware move into a register with compensating network controls and a review date, which removes the informal email approvals. The headline metric becomes internet-facing exposures older than their class deadline, and it falls from two hundred to nine over two quarters. The queue is smaller because it is honest, not because the estate shrank.