Vulnerability management is the systematic process of identifying, evaluating, and remediating software code flaws, configuration errors, and security gaps across an organization’s technology footprint.
Organizations prioritize remediation efforts using the Common Vulnerability Scoring System (CVSS), which scores security vulnerabilities on a scale from 0.0 to 10.0 based on technical severity and ease of exploitation:
Remediation Urgency Threshold = CVSS Base Score * Target Exploitation Factor

  • Critical Vulnerabilities (CVSS 9.0 – 10.0): Must be remediated or mitigated using emergency patch management protocols within 24 to 48 hours of discovery, as these flaws are actively exploited or easily compromised.
  • High Vulnerabilities (CVSS 7.0 – 8.9): Must be addressed within standard corporate maintenance windows, typically within 14 business days.
  • Medium/Low Vulnerabilities (CVSS 0.0 – 6.9): Monitored and addressed during routine system updates or managed via compensating operational controls.
PreviousNext