Checklist · Vulnerabilities & exposure
Fix the weaknesses an attacker would actually use
I use these checks to review a vulnerability programme against the five CTEM stages. Many programmes scan well and stall at mobilisation: owners, deadlines and retests.
- 21 checks
- 6 critical
- Saved in your browser
- 0/21
- checks ticked
- 0/6
- critical checks
Scoping
0/3Discovery
0/5Prioritisation
0/4Validation
0/4Mobilisation
0/5Go deeper
When a checklist is not enough.
A checklist tells you what is missing. An assessment tells you what it means, what to fix first and what it will cost.
- Exposure management (CTEM) assessmentI review how you find, rank, prove and fix exposures, then give you a prioritisation model and an owner playbook your teams can run every week.2–4 weeksFixed fee
- AppSec maturity assessmentI score your application security practices against OWASP SAMM v2 using evidence, not opinion, then turn the gaps into a roadmap your board can fund.2–3 weeksFixed fee
- Vulnerabilities & exposureScanning is rarely the problem. Ranking, proving and owning the fixes is. I follow findings from scanner to closed ticket and show where they stall.Expertise · Area 03
- Governance & maturityTools move only part of the picture. I check who owns application security, how it is measured and whether budget follows risk, using OWASP SAMM v2.Expertise · Area 06
What is the difference between CVSS, EPSS and CISA KEV?
CVSS (Common Vulnerability Scoring System) rates how severe a vulnerability is. EPSS (Exploit Prediction Scoring System) estimates the probability it will be exploited in the next 30 days. The CISA (Cybersecurity and Infrastructure Security Agency) Known Exploited Vulnerabilities (KEV) catalogue lists vulnerabilities already being exploited. Severity, likelihood and confirmed exploitation are different signals, so good prioritisation uses all three alongside asset exposure and business criticality.
Why do credentialed vulnerability scans matter?
An unauthenticated scan sees a host from the outside and infers what is installed. A credentialed scan logs in and reads installed software, patch levels and configuration directly, so it finds far more and guesses less. The catch is that a failed login silently downgrades the scan, so track authentication success for every scan, not just whether the scan completed.
Who should own vulnerability remediation?
The team that owns the asset fixes it; security owns the process and the prioritisation. Every validated exposure needs a named owner, a deadline agreed by priority and a ticket in that team’s own system. Exceptions should be approved by the business owner of the risk and carry an expiry date. For vendor-managed systems, put remediation timelines into the contract at the next renewal.