Security+Operations
Vulnerability management
Vulnerability management is the loop of find, prioritize, fix, and confirm. A scanner is only the find step.
14 min read
Objectives
- Describe the loop without treating a scan as the program
- Use exposure and impact to prioritize, not only a score
- Separate a penetration test from a vulnerability scan
On this page
Core idea
The loop is the whole topic:
- Know the assets. A scanner cannot find what is off the inventory. That is why the asset outline exists.
- Find weaknesses. Authenticated scanning sees more than a probe from the outside. A web test, in the BSCP sense, is a careful look at one application. It is not this loop by itself.
- Prioritize. A high score on an isolated system can matter less than a moderate score on the identity provider. Exposure, exploitability in the real world, and the sensitivity of the asset all change the order. The score is an input.
- Fix. Patch, change the configuration, or apply a compensating control with an owner and a deadline. “Accept the risk” is a program decision, not a technician’s shrug.
- Confirm. Rescan or retest. Unverified fixes come back as incidents.
A vulnerability scan enumerates known weaknesses and misconfigurations. It is broad and shallow. A penetration test is an authorized attempt to achieve a goal, scoped and time-boxed, which shows impact. A bug bounty is a standing invitation with rules, not a substitute for the loop. The exam asks you to tell these apart. None of them authorize you to test a system that was not in the agreement.
Patch cadence, maintenance windows, and emergency changes connect this note to change management. A patch you cannot install because the change process is missing is a governance problem showing up as an open vulnerability.
Exam lens
“We ran a scanner and have a spreadsheet” is not a program. Look for prioritization and verification in the right answer. If the stem says an outside team tried to meet an objective inside a written scope, that is a penetration test, not a scan. If the stem says you only checked version banners, you have a shallow finding, not a completed assessment.
Common pitfalls
Patching by CVSS number alone. Scanning once a year and calling it management. Letting the pentest report replace asset inventory. Testing production because a scanner makes it easy. Confusing this loop with incident response. An unpatched flaw with no evidence of use is not automatically an incident.