[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is Vulnerability Management?](/blog/vulnerability-management) Publish date December 10, 2025 {x} minute read # What is Vulnerability Management? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) Vulnerability management is the process of identifying, evaluating, prioritizing, remediating and reporting on [security vulnerabilities](https://www.upguard.com/blog/vulnerability) in web applications, computers, mobile devices [and software](https://www.upguard.com/blog/how-to-identify-vulnerable-third-party-software). Continuous vulnerability management is integral to [cybersecurity](https://www.upguard.com/blog/cyber-security) and [network security](https://www.upguard.com/blog/network-security) and is on the Center for Internet Security's (CIS) list of [basic security controls](https://www.cisecurity.org/controls/controls-list/), citing that organizations need to “continuously acquire, assess, and take action on new information in order to identify vulnerabilities, and to remediate and minimize the window of opportunity for attackers.” In short, vulnerability management provides organizations with a process to identify, prioritize and remediate possible [attack vectors](https://www.upguard.com/blog/attack-vector) and minimize their [attack surface](/blog/attack-surface).  ## What is a Vulnerability? A vulnerability is a weakness which can be [exploited](https://www.upguard.com/blog/exploit) by a [cyber attack](https://www.upguard.com/blog/cyber-attack) to gain unauthorized access to or perform unauthorized actions on a computer system. Vulnerabilities can allow attackers to run code, access a system's memory, install [malware](https://www.upguard.com/blog/malware), and steal, destroy or modify [sensitive data](https://www.upguard.com/blog/sensitive-data). The most concerning vulnerabilities for security teams are wormable [vulnerabilities](https://www.upguard.com/blog/zero-day) like the [WannaCry cryptoworm](https://www.upguard.com/blog/wannacry) [ransomware attack](https://www.upguard.com/blog/ransomware). [Computer worms](https://www.upguard.com/blog/computer-worm) are a [type of malicious software](https://www.upguard.com/blog/types-of-malware) that self-replicates, infecting other computers while remaining active on infected systems. Worms often rely on actions of and the exploitation of vulnerabilities in networking protocols, operating systems or backdoors to propagate without user knowledge.  An early example is the Morris worm. The Morris worm was one of the first internet worms and was written to highlight security flaws rather than cause damage.  It spread by exploiting known [vulnerabilities](https://www.upguard.com/blog/vulnerability), like those that would now be listed on [CVE](https://www.upguard.com/blog/cve), in Unix sendmail finger, rsh/rexec, as well as weak passwords. At its height, the Morris Worm was running on nearly 10 percent of all internet-enabled computers at the time.  The Morris Worm highlight the need for vulnerability management software and why security teams should keep their systems up-to-date. That said, the most dangerous vulnerabilities are known as [zero-day vulnerabilities](https://www.upguard.com/blog/zero-day). Zero-day vulnerabilities are unpatched vulnerabilities that are unknown to the software, hardware or firmware developers and therefore do not have a patch.  [BlueKeep (CVE-2019-0708)](https://www.upguard.com/blog/bluekeep-rdp-cve-2019-five-reasons-to-be-worried) is an example a remote code execution flaw that affects approximately one million systems (as of 29 May, 2019) running older versions of Microsoft operating systems.  This zero-day vulnerability made headlines during Microsoft's May 2019 Patch Tuesday due to its wormability. This means successful [cyber attacks](https://www.upguard.com/blog/cyber-attack) using BlueKeep can propagate in a similar way to[ WannaCry's](https://www.upguard.com/blog/wannacry) EternalBlue exploit.  Microsoft saw BlueKeep as such a large [cyber threat](https://www.upguard.com/blog/cyber-threat) to [information security](https://www.upguard.com/blog/information-security) and [cybersecurity](https://www.upguard.com/blog/cyber-security) that they released patches for out-of-support and end-of-life operating systems like Windows 2003 and Windows XP. ## Why is Vulnerability Management Required? Increasing growth in cyber crime and growing regulatory scrutiny is forcing organizations to focus more attention on information security. A vulnerability management process should be part of an organization's overall [information risk management strategy](https://www.upguard.com/blog/information-risk-management).   This process allows organizations to obtain a continuous overview of vulnerabilities in their IT environment and the risks associated with them. Only by identifying and mitigating vulnerabilities can organizations reduce the risk of attackers exploiting new vulnerabilities, patching identified vulnerabilities as they are listed on [CVE](/blog/cve) and other vulnerability databases is an effective risk management strategy that reduces [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk). [Learn the key features of effective risk remediation software >](https://www.upguard.com/blog/choosing-cyber-risk-remediation-software) ## What is the Vulnerability Management Process? The vulnerability management process is a cyclical practice of identifying, classifying, remediating and mitigating security vulnerabilities. The essential elements to any vulnerability management program are vulnerability detection, [vulnerability assessment](/blog/vulnerability-assessment) and reporting. [Read our full post on vulnerability assessment here](/blog/vulnerability-assessment). ## How are Vulnerabilities Detected? At the heart of a typical vulnerability management tool is a vulnerability scanner.  A vulnerability scanner is software designed to assess computers, networks or applications for known vulnerabilities like those listed on [CVE](https://www.upguard.com/blog/cve). Vulnerability scanning can identify and detect vulnerabilities arising from misconfiguration and flawed programming within a network and perform authenticated and unauthenticated scans: * **Authenticated scans:** Allow vulnerability scanners access networked resources using remote administrative protocols like secure shell (SSH) or remote desktop protocol (RDP) and authenticate using provided system credentials. The benefit of authenticated scans is that they provide access to low-level data such as specific services, configuration details and accurate information about operating systems, installed software, configuration issues, [access control](https://www.upguard.com/blog/access-control), security controls and patch management. * **Unauthenticated scans: **Do not provide access to networked resources, which can result in false positives and unreliable information about operating systems and installed software. This type of scan is generally used by cyber attackers and IT security analysts to try and determine the security posture of externally facing assets, [third-party vendors](https://www.upguard.com/blog/third-party-vendor) and to find possible [data leaks](https://www.upguard.com/blog/data-leak). Like any security service, vulnerability scanners aren't perfect, which is why other techniques like [penetration testing](/blog/penetration-testing) and Google hacking are employed by organizations.   Penetration testing is the practice of testing an information technology asset to find exploitable vulnerabilities and can be automated with software or performed manually.  Whether automated or manual, pen testing gathers information about its target, identifies possible attack vectors and then attempts to exploit them. Pen testers will then report on their findings. It can also be used to test on-premise security controls, adherence to [information security policies](https://www.upguard.com/blog/information-security-policy), employees susceptibility to [social engineering attacks](https://www.upguard.com/blog/social-engineering) like [phishing](https://www.upguard.com/blog/phishing) or [spear phishing](https://www.upguard.com/blog/spear-phishing), as well as to test [incident response plans](https://www.upguard.com/blog/incident-response-plan). Google hacking is the use of a search engine to locate security vulnerabilities. IT teams and attackers alike can use advanced search operators in queries that locate hard-to-find information or information that is being accidentally exposed through misconfiguration of security tools and cloud services. These vulnerabilities tend to fall into two categories, namely software vulnerabilities and misconfigurations. ## What is the Vulnerability Assessment Process? The vulnerability assessment process can be broken down into five steps: 1. **Identify vulnerabilities: **Analyzing network scans, pen test results, firewall logs, and vulnerability scan results to find anomalies that suggest a [cyber attack](https://www.upguard.com/blog/cyber-attack) could take advantage of a vulnerability.  2. **Verify vulnerabilities: **Decide whether the identified vulnerability could be exploited and classify the severity of the exploit to understand the level of security risk. 3. **Prioritization of vulnerabilities: **Assess which vulnerabilities will be mitigated or remediated first based on their wormability and other risks.  4. **Mitigate vulnerabilities: **Decide on countermeasures and how to measure their effectiveness in the event that a patch is not available. 5. [**Remediate vulnerabilities**](https://www.upguard.com/blog/vulnerability-remediation)**: **Removing and fixing known vulnerabilities to prevent further exploitation. After vulnerabilities are identified, they need to be evaluated to understand what risks they pose, possible security solutions and how they will be dealt with in accordance to your organization's risk management strategy.  Vulnerability management solutions can provide [security ratings](https://www.upguard.com/blog/what-are-security-ratings), such as Common Vulnerability Scoring System (CVSS) scores, which can help organizations understand which vulnerabilities should be focused on first.  Some additional things to consider include: * Is the vulnerability a false positive? * Is this vulnerability exploitable from the Internet or would an attacker need physical access * How difficult is it to exploit this vulnerability? * Is there publicly available exploit code for this vulnerability? * What is the business impact if this vulnerability were exploited? * Is your organization employing a [defense in depth](/blog/defense-in-depth) strategy that reduces the likelihood and/or impact of this vulnerability being exploited? * How old is the vulnerability? * Does your organization have regulatory requirements like [CCPA](https://www.upguard.com/blog/what-is-the-ccpa), [FISMA](https://www.upguard.com/blog/fisma), [GLBA](https://www.upguard.com/blog/glba), [PIPEDA](https://www.upguard.com/blog/pipeda) or [the NIST Cybersecurity Framework](https://www.upguard.com/blog/nist-cybersecurity-framework)? * [What is the average cost of a data breach in your industry?](https://www.upguard.com/blog/cost-of-data-breach) Once a vulnerability has been deemed an acceptable [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk), the next step is to prioritize how it will be treated: * **Remediation: **The vulnerability is patched and cannot be exploited. * **Mitigation: **The likelihood or impact that the vulnerability can be exploited is minimized. * **Acceptance: **No action is taken because the vulnerability is deemed low risk or the cost is substantially greater than the cost incurred by your organization if it were exploited.  Many vulnerability management systems will provide recommended remediation techniques for common vulnerabilities, which can be as simple as installing a readily-available security patches or as complex as replacing hardware. ## Should Vulnerabilities Be Publicly Reported? There is ongoing debate about whether new vulnerabilities should be reported by organizations who find them, it remains a contentious issue with two opposing sides: 1. **Immediate full disclosure:** Some cybersecurity experts argue for immediate disclosure including specific information about how to exploit the vulnerability. Supporters of immediate disclosure believe it leads to secure software and faster patching improving software security, application security, computer security, operating system security and [information security](https://www.upguard.com/blog/information-security). 2. **Limited to no disclosure:** While others are against vulnerability disclosure because they believe the vulnerability will be exploited. Supporters of limited disclosure believe limiting information to select groups reduces the risk of exploitation. Like most arguments, both sides have valid points. [Learn more about vulnerability disclosure programs here >](https://www.upguard.com/blog/vulnerability-disclosure-programs) ## Should I Worry About My Third-Party Vendors' Vulnerabilities? [Vendor risk management (VRM)](https://www.upguard.com/blog/vendor-risk-management) is an often overlooked part of vulnerability management. It is no longer enough to solely focus on your internal [cybersecurity](https://www.upguard.com/blog/cyber-security). If your [third-party vendors](https://www.upguard.com/blog/third-party-vendor) don't have the same security solutions and security standards in place, you and your customer's [sensitive data](https://www.upguard.com/blog/sensitive-data) is at risk.  Yes, outsourcing can introduce strategic advantages (lower costs, access to expertise and organizational focus). That said, it can also introduce additional vulnerabilities that aren't in your immediate control, making [cyber attacks](https://www.upguard.com/blog/cyber-attack) and [corporate espionage](https://www.upguard.com/blog/corporate-espionage) possible.  Third-party vendors with poor [information security](https://www.upguard.com/blog/information-security) introduce significant [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk) in the form of third-party risk and [fourth-party risk](https://www.upguard.com/blog/what-is-fourth-party-risk). This is where VRM can help. VRM programs are concerned with management and monitoring of third and fourth-party risk, as well as ensuring that customer data and enterprise data is not exposed in third or fourth-party [data breaches](https://www.upguard.com/blog/data-breach) and [data leaks](https://www.upguard.com/blog/data-leak).  Increased regulatory scrutiny means that vendor risk management teams are spread thin and need to look at automating as much as possible including vendor questionnaires. Don't make the mistake of only negotiating service-level agreements with potential vendors, monitor vendors in real-time and request remediation of high-risk vulnerabilities or change vendors. Your organization's [information security policy](https://www.upguard.com/blog/information-security-policy) needs to focus on both first, third and fourth-party security postures, which means investing the time to develop a robust [third-party risk management framework](https://www.upguard.com/blog/third-party-risk-management-framework). And ask for your vendor's [SOC 2](https://www.upguard.com/blog/soc-2) report. You may even be legally liable for third-party data breaches that result from poor vulnerability management depending on your industry.  ## How UpGuard Can Help You Identify High-Risk Vulnerabilities and Request Remediation Companies like [Intercontinental Exchange](https://www.upguard.com/customers/ice-nyse), [Taylor Fry](https://www.upguard.com/customers/taylor-fry), [The New York Stock Exchange](https://www.upguard.com/customers/ice-nyse), IAG, First State Super, Akamai, Morningstar and NASA use UpGuard to protect their data, [prevent data breaches](https://www.upguard.com/blog/prevent-data-breaches), monitor for [vulnerabilities](https://www.upguard.com/blog/vulnerability) and avoid [malware](https://www.upguard.com/blog/malware). We're experts in [data breaches](https://www.upguard.com/blog/data-breach) and [data leaks](https://www.upguard.com/blog/data-leak), our [research](https://www.upguard.com/breaches) has been featured in the [New York Times](https://www.nytimes.com/2018/07/20/business/suppliers-data-leak-automakers.html), [Wall Street Journal](https://www.wsj.com/articles/computer-security-firm-says-voter-data-set-left-unprotected-online-1497877200), [Bloomberg](https://www.bloomberg.com/news/articles/2019-06-27/ford-td-bank-files-found-online-in-cloud-data-exposure), [Washington Post](https://www.washingtonpost.com/news/the-switch/wp/2017/12/22/you-may-not-know-much-about-the-companies-exposing-your-personal-information-but-they-know-a-lot-about-you), [Forbes](https://www.forbes.com/sites/lconstantin/2017/07/17/cloud-storage-error-exposes-over-two-million-dow-jones-customer-records), [Reuters](https://www.reuters.com/article/facebook-privacy/millions-of-facebook-records-found-on-amazon-cloud-servers-upguard-idUSL3N21L3R4) and [Techcrunch.](https://techcrunch.com/2019/09/18/russia-sorm-nokia-surveillance/) UpGuard's [Vendor Risk Management tool](https://www.upguard.com/product/vendor-risk) streamlines the management of third-party relationships, allowing your team to reclaim valuable time through the automation of vendor questionnaires. This powerful tool also continuously monitors your vendors' security posture and provides critical benchmarking data, ensuring your organization can efficiently assess and mitigate cyber risk over time. Each vendor is rated against 70+ criteria such as presence of [SSL](https://www.upguard.com/blog/ssl-certificate) and [DNSSEC](https://www.upguard.com/blog/dnssec), as well as risk of [domain hijacking](https://www.upguard.com/blog/domain-hijacking), [man-in-the-middle attacks](https://www.upguard.com/blog/man-in-the-middle-attack) and [email spoofing](https://www.upguard.com/blog/email-spoofing) for [phishing](https://www.upguard.com/blog/phishing). Each day, our platform scores your vendors with a [Cyber Security Rating](https://www.upguard.com/blog/what-are-security-ratings) out of 950. We'll alert you if their score drops. [UpGuard Breach Risk](https://www.upguard.com/product/breach-risk) can help monitor for DMARC, combat [typosquatting](https://www.upguard.com/blog/typosquatting), prevent [data breaches](https://www.upguard.com/blog/data-breach) and [data leaks](https://www.upguard.com/blog/data-leak), avoiding regulatory fines and protecting your customer's trust through [cyber security ratings](https://www.upguard.com/blog/what-are-security-ratings) and continuous exposure detection.  Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)