Expertise 03 · Vulnerabilities
Fix the weaknesses an attacker would actually use, first
Scanning is rarely the problem. Ranking, proving and owning the fixes is. I follow findings from scanner to closed ticket and show where they stall.
In short
Vulnerability and exposure management is the process of finding, ranking, validating and fixing weaknesses across infrastructure, applications and code. I assess it against the CTEM (continuous threat exposure management) cycle: scanner and testing coverage, prioritisation beyond CVSS (Common Vulnerability Scoring System) using exploit evidence and business context, validation of what is exploitable, and whether every fix has an owner and a deadline.
What I check
- Scanner coverage against the asset inventory
- Credentialed and authenticated scanning
- SAST, DAST and SCA in the delivery pipeline
- Prioritisation beyond CVSS: KEV, EPSS, exposure
- Validation of exploitability before escalation
- Time to remediate by owner and by service
The threats
What this area has to stop.
The attacks I see most often in this area, and what they cost when they land.
Open the attack simulator- Threat 01Known exploited flaw left openA vulnerability on the CISA KEV list sits on an internet-facing system past its deadline.Breach through a door everyone knew aboutSee which layer stops it
- Threat 02Forgotten internet-facing assetA host or app nobody registered is never scanned, patched or monitored.An unmanaged way into the network
- Threat 03Vulnerable open-source componentAn outdated library inside an in-house app carries a public exploit nobody tracked.Compromise through code you did not write
- Threat 04Chained medium findingsLow-rated misconfigurations combine into a path to privileged credentials.Critical impact from findings ranked minor
- Threat 05Exceptions that never expireA risk accepted once to meet a deadline stays accepted for years without review.Permanent gaps hidden behind approvals
The defences
How good looks, layer by layer.
- 01External attack surfaceFinds what the internet can see: domains, hosts, certificates and exposed services.Attack surface discovery, certificate logs
- 02Hosts and networksCredentialed scans read patch levels and configuration inside each system.Agent and credentialed network scanning
- 03Web apps and APIsAuthenticated testing exercises the application the way a logged-in user would.Authenticated DAST, web app scanning
- 04Code and componentsFinds flaws in your own code and in the open-source libraries built into it.SAST, SCA, SBOM
Maturity
Where are you on the staircase?
Four levels I use to score this area. Most improvement plans aim one step up within a year.
- L0Ad hoc scanning
- Scans run before audits; results sit in PDF reports
- No asset inventory to measure coverage against
- L1Scanning by CVSS
- Regular scans, but unauthenticated and incomplete
- Fixes ranked by CVSS score; few named owners
- L2Risk-based
- Credentialed scans; SAST and DAST on key apps
- KEV, EPSS and exposure set priority; owners named
- L3Continuous (CTEM)
- Scoped by business service; exploits validated
- Tickets, expiring exceptions and re-tests by default
Measure it
Four numbers worth tracking.
- KPI 01Median time to remediateFor validated, high-priority exposures only. Averages across all findings hide what matters.
- KPI 02Credentialed scan coverageShare of in-scope assets with a recent credentialed scan. Unscanned assets are unknown risk.
- KPI 03Open KEV findings on exposed assetsKnown exploited flaws on internet-facing systems, shown as a trend. The number to drive down.
- KPI 04Exceptions past expiryAccepted risks nobody re-approved. A direct test of whether the exception process is real.
Frameworks I assess against
- Gartner CTEM
- CVSS
- EPSS
- CISA KEV catalogue
- OWASP Top 10
Work with me
How I can help with this area.
- Exposure management (CTEM) assessmentI review how you find, rank, prove and fix exposures, then give you a prioritisation model and an owner playbook your teams can run every week.2–4 weeksFixed fee
- AppSec maturity assessmentI score your application security practices against OWASP SAMM v2 using evidence, not opinion, then turn the gaps into a roadmap your board can fund.2–3 weeksFixed fee
- Exposure management checklistCheck a vulnerability programme against the five CTEM stages, scoping to mobilisation.Free · interactive
What is the difference between vulnerability management and exposure management?
Vulnerability management usually means scanning, ranking findings by severity and sending reports. Exposure management, often run as CTEM (continuous threat exposure management), starts by scoping around business services, adds exposures scanners miss such as misconfigurations and unknown assets, validates what is exploitable and mobilises owners to fix it. Scanning stays an input, not the whole programme.
Why do credentialed scans matter?
An unauthenticated scan sees a system from the outside, like an attacker on the network. A credentialed scan logs in and reads installed software, patch levels and configuration, so it finds far more of what actually needs fixing. Authenticated web application scanning is the equivalent for apps: it tests the pages and APIs (application programming interfaces) only logged-in users can reach.
What are EPSS and CISA KEV?
EPSS (Exploit Prediction Scoring System), maintained by FIRST (the Forum of Incident Response and Security Teams), estimates the probability that a vulnerability will be exploited in the next 30 days. The CISA (Cybersecurity and Infrastructure Security Agency) KEV (Known Exploited Vulnerabilities) catalogue lists flaws with confirmed exploitation in the wild. Used alongside severity scores, both help teams fix what attackers actually use first.
Do SAST and DAST replace penetration testing?
No. SAST (static application security testing) reads code for flaws, and DAST (dynamic application security testing) probes a running application from outside. Both scale well and belong in the delivery pipeline. A penetration test adds a skilled person who chains findings, tests business logic and abuses authorisation in ways tools miss. Use tools for breadth and testers for depth.
Where should a vulnerability programme start improving?
With ownership and one scope. Pick an internet-facing business service, reconcile its assets across scanners and the CMDB (configuration management database), switch on credentialed scanning, and enrich findings with KEV (Known Exploited Vulnerabilities) status and EPSS (Exploit Prediction Scoring System) scores. Give every validated finding an owner and a deadline, then expand to the next service once the cycle runs reliably.