The vulnerability management cycle: prioritisation, tracking and deadlines
You run vulnerability management as a cycle: you prioritise with asset criticality, CVSS environmental metrics, EPSS and known-exploited lists, manage deadlines and exceptions, and report with metrics.
Level 301 · 18 lessons · 15 practice labs
Lessons
Process
- The cycle: discover, assess, remediate, verify, report
- Asset criticality: half of the priority
- Roles: security team, system owner, change board
- Short task: fill in a responsibility table for an organisation
Prioritisation
- Adapting the score with CVSS environmental metrics
- Likelihood of exploitation: EPSS and the known-exploited vulnerabilities list
- Reachability context: internet-facing or internal?
- Prioritising with decision trees: SSVC
- Short task: rank twenty vulnerabilities with three methods and explain the differences
Tracking
- Remediation deadlines: service levels by severity
- Ticketing: turning a finding into tracked work
- The exception and risk-acceptance process
- When there is no patch: compensating controls
- Working with patch management: testing, rollout, rollback
- Short task: set up a vulnerability tracker and flag overdue items
Measuring
- Metrics: mean time to remediate and the age of open vulnerabilities
- The monthly vulnerability report: technical and executive views
- Capstone: run a fictional organisation’s vulnerability management cycle for three months
Practice labs
- Fill a vulnerability management responsibility table: Record who is responsible for discovery, assessment, fixing and verification at Pusulaya Sigorta.
- Assign criticality ratings to assets: Assign business-impact criticality to a forty-asset inventory and note the reasons.
- Find assets without owners and propose owners: Compare the inventory with scan results, list owner-less assets and propose a responsible team for each.
- Adjust the score to the organisation with CVSS environmental metrics: Enter environmental metrics for a finding on an internal server and explain the changed severity.
- Rank findings by exploit likelihood and the known-exploited list: Add EPSS values and known-exploited status to twenty findings and rebuild the order.
- Rank twenty vulnerabilities three ways and explain the differences: Produce separate rankings with CVSS, EPSS and an SSVC decision tree, and explain the five items that moved most.
- Turn a finding into a complete work ticket: Write a ticket with summary, affected asset, evidence, fix step and due date.
- Flag overdue items in a vulnerability tracking sheet: Apply deadlines by severity, find overdue items and draft the reminder to their owners.
- Track a patch rollout with test, deploy and rollback steps: Write the test group, rollout order and rollback condition for a patch at Ilgıntepe Tekstil and link them to the tracker.
- Review a risk acceptance request and list what is missing: Check the request's duration, justification and approver, and write feedback on the missing fields.
- Apply a compensating control for an unpatched vulnerability: Apply an access-restricting control on the lab server and confirm the vulnerable service is now reachable only from the allowed address.
- Find expired exceptions and reassess them: List expired items in the exception register and record a close, extend or fix decision with reasons for each.
- Calculate the mean time to remediate: Calculate mean time to remediate per severity from the open and close dates of closed findings.
- Report open vulnerability age per team: Group open findings by age band and team, and list the ten oldest items.
- Write the quarterly vulnerability report in technical and executive views: Extract trends from Selvikent Belediyesi's quarterly data and prepare a one-page executive summary and a technical appendix.
About this course
You run vulnerability management as a cycle: you prioritise with asset criticality, CVSS environmental metrics, EPSS and known-exploited lists, manage deadlines and exceptions, and report with metrics.
What you will learn
- Process
- Prioritisation
- Tracking
- Measuring
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.