Building a Vuln Management Program

A critical CVE lands on a Friday afternoon. Leadership pings you: are we exposed? If your honest answer is "give me a few days to find out," the vuln is not your real problem. Not knowing what you run is. Every vulnerability management program lives or dies on the asset inventory underneath it, and most of them are built on sand.

Inventory first, everything else second

You cannot scan, prioritize, or patch a host you do not know exists. The hard part is that no single source of truth is complete. Your CMDB is six months stale. DHCP shows leases but not what is on them. The cloud console knows your EC2 fleet and nothing about the laptop running in someone's kitchen.

Pull from several sources and reconcile the gaps. Each one catches what the others miss.

• Cloud provider APIs: aws ec2 describe-instances, Azure Resource Graph, GCP Cloud Asset Inventory. Authoritative for what runs in the account, blind to everything else.
• EDR and patch-agent rosters: CrowdStrike, Defender, your Nessus or Qualys agent. Solid for managed endpoints, silent on the printer and the IoT camera.
• Active network discovery: an nmap sweep or your scanner's discovery job finds the things no agent covers.
• DHCP and DNS logs, plus switch ARP tables, catch the transient devices that are gone by morning.

The number that should worry you is the delta: hosts the network sweep found that your CMDB never listed. That gap is your unmanaged attack surface, and it is where you get hit.

Cadence: match the clock to the change rate

A quarterly scan in a shop that redeploys containers hourly is theater. Tie frequency to how fast the environment actually moves.

Run discovery continuously or daily so new assets get seen within a day of appearing. Run authenticated vuln scans weekly on the managed fleet. Scan internet-facing ranges at least monthly, since that is what attackers see first. And keep an emergency path: when a KEV-listed CVE drops, you fire an ad-hoc scan scoped to the affected software the same day, not at the next scheduled window.

Ownership: a finding with no owner never closes

A vuln with nobody's name on it sits in a queue until it surfaces in a breach report. Map every asset to a team and a human who can actually apply the fix. A plain RACI does the job: the asset owner is accountable, the platform team is responsible for the patch, security is consulted, leadership is informed.

Without that map, your scanner is a very expensive machine for generating lists that nobody acts on. The inventory tells you what exists. Ownership is what turns a finding into work that gets done.