Building and Operating an Enterprise Vulnerability Management Program (VMP): A Practical Guide

Why Vulnerability Management Is Hard

More than 80% of major security incidents in Korea occur through known vulnerabilities (ones that already have patches available). When hundreds of CVEs pour in every month across thousands of assets, the core challenge is deciding what to patch and when.

The Four-Stage VMP Framework

Stage 1: Build an Asset Inventory

# Nmap
nmap -sV -O --osscan-guess \
  -oX assets.xml \
  192.168.0.0/24

Stage 2: Vulnerability Scanning

Scanning tools:

• Free: OpenVAS/Greenbone, Nuclei
• Commercial: Tenable Nessus, Qualys VMDR, Rapid7 InsightVM

# Nuclei
nuclei -u https://app.company.com \
  -t cves/ \
  -severity critical,high \
  -o results.txt

Stage 3: Risk Prioritization

CVSS alone is not enough. CVSS measures the severity of the vulnerability itself, not the risk in your environment.

def calculate_priority(cve):
    score = cve.cvss_score * 10

 # (CISA KEV list)
    if cve.in_cisa_kev:
        score += 50

 #
    if cve.asset.internet_facing:
        score += 30

 return score # 70 when

Stage 4: Patch Management SLAs

Always apply patches in this order: test environment → staging → production.

Vulnerability Management KPIs

• MTTD: Mean time from vulnerability disclosure to internal detection
• MTTP: Mean time from detection to patch completion
• Patch rate: Percentage of patches completed within the SLA window

Vulnerability management cannot be done by the security team alone. You need a process built together with development, infrastructure, and leadership for it to be sustainable.

Beyond CVSS: EPSS and KEV

If you prioritize by CVSS score alone, you will miss the vulnerabilities that are actually being exploited. Use both of these signals together.

• CISA KEV (Known Exploited Vulnerabilities): A catalog of vulnerabilities confirmed to have been used in real attacks → treat as highest priority.
• EPSS (Exploit Prediction Scoring System): Probability (0–1) that a vulnerability will be exploited in the next 30 days. Even a CVSS 9.8 can be deprioritized if its EPSS is low.

# KEV + EPSS
def priority(cve):
 if cve.in_cisa_kev: #
 return ""
    if cve.epss >= 0.5 and cve.asset.internet_facing:
 return ""
    if cve.cvss >= 9.0:
 return ""
 return " "

When You Cannot Patch Immediately: Compensating Controls

Many assets cannot be patched immediately due to operational-disruption risk or compatibility issues. In those cases, buy time with virtual patching.

• Block exploit traffic for the vulnerability with WAF/IPS signatures.
• Cut external exposure of the vulnerable service (access control, segmentation).
• Even after applying compensating controls, track the permanent patch schedule as a ticket.

Container and Cloud Vulnerability Management

# (CI )
trivy image --exit-code 1 --severity CRITICAL,HIGH my-app:latest

# IaC settings
trivy config ./terraform

An image is not “done” once it is built. Existing images in the registry must be rescanned whenever new CVEs are published.

Alignment with Korean Regulations

• ISMS-P: Periodic vulnerability assessments and tracking of remediation results are certification control items.
• Critical Information and Communications Infrastructure (CII): At least one vulnerability analysis and assessment per year is a legal obligation under the Act on the Protection of Information and Communications Infrastructure.
• Scanning without tracking remediation will cause problems in both certification audits and incident response.

When Scanner Results Don't Match Real Assets

A frequent VMP problem isn't the number of findings but assets that never get scanned. An asset missing from the report isn't risk-free; it's invisible.

Causes

• Short-lived assets such as autoscaled instances and containers appear and disappear between scan cycles
• Credentialed-scan accounts expire on some servers, leaving only shallow network-level results
• New cloud accounts were created but never added to the scanner integration

Reconciliation

1. Pull the reference asset list from real sources (cloud APIs, EDR agent inventory, DHCP/DNS records), not the CMDB.
2. Compare with assets the scanner covered in the last N days.

# e.g. compare running EC2 instances with the scanner export
aws ec2 describe-instances --filters Name=instance-state-name,Values=running \
  --query 'Reservations[].Instances[].PrivateIpAddress' --output text | tr '\t' '\n' | sort > live.txt
cut -d, -f1 scanner_last30d.csv | sort > scanned.txt
comm -23 live.txt scanned.txt     # running but never scanned

3. Check credentialed-scan success per asset and track authentication failures as a separate list.

Fix and prevention

• For containers, complement runtime scanning with registry and CI-stage image scans, linked to the list of running images.
• Add scan coverage (share of real assets scanned) to the KPIs and report it alongside vulnerability counts.

FAQ

Q. Our scanner dumps too many findings. Where do we start? Start with the intersection of the KEV catalog and internet-facing assets. “Exploitable × exposed” is the real risk.

Q. We’re afraid a patch will break the service. That’s why you need test → staging → production stages and a rollback plan. Accumulated patch avoidance becomes the biggest risk of all.

References

• CISA KEV — Known Exploited Vulnerabilities Catalog
• FIRST EPSS — Exploit Prediction Scoring System