A recent practical guide on vulnerability management examines what happens after scanners detect weaknesses, using the example of the largest report the author has handled: an 1,819-page document whose Excel export contained 2.2 million rows and could not be opened because of the 1,048,576-row limit per sheet.
The guide, part seven of the series “Vulnerability Management for Beginners,” notes that detection represents only about 10 percent of the effort. The remaining 90 percent consists of analysis, prioritization, development of remediation measures, actual elimination, and verification that the issue has been resolved and does not return.
BI.ZONE and Sber research shows that the median Time-to-Exploit has fallen roughly twenty-fold over two and a half years and now stands below 40 days for many vulnerabilities. For edge devices listed in CISA’s Known Exploited Vulnerabilities catalog, Verizon DBIR data indicate a median of zero days from disclosure to mass exploitation. Qualys analysis of more than one billion remediation records across more than ten thousand organizations found that 85 percent of KEV-vulnerable assets were still unpatched on the day of disclosure.
Because organizations can typically close only one in ten open vulnerabilities each month, according to studies by the Cyentia Institute and Kenna Security, the process must focus on closing the right vulnerabilities rather than attempting to close all of them. Hadrian analysis of three hundred infrastructures determined that only 0.47 percent of scanner findings are actually exploitable in practice.
The author recommends continuous, structured scanning that covers the entire infrastructure, including shadow IT, with separate high-frequency schedules for perimeter assets. Technological maintenance windows should be agreed in advance with system owners, and internal servers and VPN gateways should operate under different timeframes.
Instead of distributing massive reports, teams should maintain two documents: a detailed report for audits and a concise registry for administrators. The registry must answer four questions—what to install, where to install it, the deadline or SLA, and the consequences of inaction—while omitting CVSS vectors and lengthy descriptions.
Tasks should be created per update package rather than per CVE, assigned to specific teams, and closed only when the vulnerability no longer appears in a subsequent scan. Every finding has exactly three legitimate outcomes: patching, compensating controls, or documented risk acceptance that includes the decision maker, justification, compensating measures, expiration date, and scheduled review.
