GLOSSARY

The continuous practice of identifying, assessing, prioritising, remediating, and verifying weaknesses across systems, software, devices, and services.

Effective vulnerability management reduces exploitable exposure, focuses scarce remediation capacity on material risk, supports assurance obligations, and provides leadership with measurable security debt.

An organisation combines authenticated scanning, cloud inventory, threat intelligence, and service criticality to prioritise an internet-facing exploited flaw, patch it under an emergency change, and rescan to verify closure.

Scanner severity alone is not business risk, and complete elimination is unrealistic. Unknown assets, false positives, unsafe patches, weak ownership, and unverified remediation leave material exposure.

A programme maintains asset context, discovers vulnerabilities and misconfigurations, enriches findings with exploitability and business impact, assigns treatment, deploys patches or compensating controls, validates remediation, manages exceptions, and monitors coverage and ageing.