Vulnerability Management

Vulnerability management continuously finds, prioritizes and fixes weaknesses before attackers exploit them. This roadmap covers the full program, from asset inventory to executive reporting. IT basics are enough to start.

• Know what assets your environment has
• Have a lab to scan
• Plan your study time

• CyberA4U Academy — courses

You can't protect what you don't know about. An accurate asset inventory with owners and criticality is the foundation of vulnerability management.

• Build and maintain an asset inventory
• Assign owners and criticality
• Find unknown assets

الأدوات والتقنيات: VM

• CIS Critical Security Controls

Vulnerability scanners use network, agent and cloud-API methods. Placement and credentials determine what they can see.

• Compare network, agent and API-based scanning
• Place scanners for coverage
• Schedule scans safely

الأدوات والتقنيات: VM

تعلّمها على CyberA4U:Module 7: Identifying and Assessing Weaknesses

• Greenbone Community Edition (OpenVAS) documentation

Authenticated scans log in to systems and find far more accurate results than unauthenticated scans — using dedicated, least-privilege scan accounts.

• Configure credentialed scans
• Use dedicated scan accounts with minimal rights
• Compare results with unauthenticated scans

الأدوات والتقنيات: VM

• Greenbone Community Edition (OpenVAS) documentation

CVSS rates technical severity; EPSS estimates the probability of exploitation. Together they give a better picture than either alone.

• Read CVSS vectors
• Use EPSS scores
• Combine them with context

الأدوات والتقنيات: VM

تعلّمها على CyberA4U:Module 7: Identifying and Assessing Weaknesses

• FIRST — Common Vulnerability Scoring System (CVSS)
• FIRST — Exploit Prediction Scoring System (EPSS)

Prioritize by real risk: known exploitation (CISA KEV), exploit likelihood, asset criticality and exposure — not by severity alone.

• Use KEV, EPSS and SSVC in decisions
• Factor in asset criticality and exposure
• Define remediation timelines by risk

الأدوات والتقنيات: VM

• CISA — Stakeholder-Specific Vulnerability Categorization (SSVC)
• CISA — Known Exploited Vulnerabilities Catalog

Remediation needs clear ownership, tickets, deadlines and verification that the fix worked.

• Route findings to the right owners
• Track deadlines and progress
• Verify fixes with rescans

الأدوات والتقنيات: VM

تعلّمها على CyberA4U:Module 7: Identifying and Assessing Weaknesses

• CISA — Stakeholder-Specific Vulnerability Categorization (SSVC)

Some vulnerabilities can't be fixed on time. Exceptions must be justified, approved, time-limited and backed by compensating controls.

• Define the exception process
• Require compensating controls
• Review and expire exceptions

الأدوات والتقنيات: VM

• NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments

Useful KPIs include time to remediate by severity, KEV exposure, scan coverage and exception trends.

• Choose outcome-focused KPIs
• Show trends over time
• Report per team or business unit

الأدوات والتقنيات: VM

• CIS Critical Security Controls

In the cloud, misconfigurations matter as much as software flaws. Posture management tools check both continuously.

• Scan cloud workloads and images
• Include misconfigurations in the program
• Use provider security findings

الأدوات والتقنيات: VM

• AWS Security Hub — Foundational Security Best Practices standard

Container images carry their own vulnerable packages. Scan them in CI and in registries, and rebuild regularly.

• Scan images with Trivy or similar
• Fail builds on agreed thresholds
• Rebuild images when base images are updated

الأدوات والتقنيات: VM

• Trivy — vulnerability scanner (GitHub)

External attack surface management discovers internet-facing assets — forgotten domains, test servers, exposed services — that attackers see first.

• Discover internet-facing assets
• Identify unknown or unmanaged systems
• Feed findings into remediation

الأدوات والتقنيات: VM

• CISA — Cyber Hygiene Services

When a critical vulnerability is actively exploited, vulnerability management and incident response must work together: find exposure, patch or mitigate, and hunt for compromise.

• Define an emergency vulnerability process
• Coordinate patching and threat hunting
• Communicate status quickly

الأدوات والتقنيات: VM

• CISA — Known Exploited Vulnerabilities Catalog

Executives need to know overall exposure, trends and which decisions or resources are needed — not long lists of CVEs.

• Summarize exposure in business terms
• Show trends and hotspots
• Request clear decisions

الأدوات والتقنيات: VM

• NIST IR 8286 — Integrating Cybersecurity and Enterprise Risk Management

Review the program regularly: coverage gaps, slow remediation areas, recurring issues and process friction.

• Review metrics and root causes
• Fix process bottlenecks
• Mature toward automation

الأدوات والتقنيات: VM

• CIS Critical Security Controls

Check that you can run a vulnerability program from discovery to verified fix, prioritized by real risk.

• Maintain inventory and scanning coverage
• Prioritize with KEV, EPSS and context
• Track, verify and report remediation

• CyberA4U CTF Arena — practice challenges

You can now run vulnerability management. Continue with Blue Team Fundamentals, Cloud security roadmaps or Incident Response.

• Keep your lab scanner
• Choose your next roadmap
• Share your prioritization method

• CyberA4U CTF Arena — practice challenges