Vulnerability Management and Security Testing
From discovery to remediation
Core workflow
Vulnerability management is a cycle: discover assets, identify weaknesses, prioritize by risk, remediate, and verify closure. The best programs focus on exposure reduction, not just scan counts.
Testing methods
| Method | What it finds |
|---|---|
| Automated scanning | Known vulnerabilities and misconfigurations |
| Manual testing | Logic flaws and complex attack paths |
| Penetration testing | Realistic exploitation paths and impact |
| Code review | Design and implementation weaknesses |
Prioritization factors
Risk-based thinking
A medium-severity issue on an internet-facing system may matter more than a high-severity issue on a tightly isolated asset.
Practical remediation flow
-
1
Confirm the finding and reduce false positives.
-
2
Assign an owner and due date.
-
3
Apply a patch, configuration change, or control.
-
4
Retest to verify the issue is resolved.
-
5
Document residual risk if full remediation is not yet possible.
What is the best first step after a scanner finds a vulnerability?
Findings should be validated and ranked by risk before action.
Correct answer: Confirm and prioritize it
Why can asset criticality change remediation priority?
High-value assets deserve faster and stronger protection.
Correct answer: Because some systems support more important business functions and create more risk if compromised
Which activity is most associated with verifying whether a flaw is truly exploitable?
Retesting checks whether the remediation worked and whether the issue is still exploitable.
Correct answer: Retesting
What is a compensating control?
Examples include segmentation, monitoring, or access restrictions.
Correct answer: A control that reduces risk when the preferred fix is not yet possible