Vulnerability management

Vulnerability management is the ongoing program through which a company finds the flaws in its systems, ranks them and gets them fixed within a deadline it has set for itself. Patching is only the last step. October 2023: Citrix ships the fix for Citrix Bleed on its NetScaler appliances. Companies that patch without killing active sessions stay exposed, because session tokens stolen before the update are still valid. A program that tracks vendor advisories caught that; a plain update calendar did not. The cycle starts with the asset inventory, then the scan, ideally authenticated, which reads installed versions instead of guessing them from outside. Then comes prioritization. The CVSS (Common Vulnerability Scoring System) score measures theoretical severity. The KEV (Known Exploited Vulnerabilities) catalog kept by CISA (Cybersecurity and Infrastructure Security Agency) and the EPSS (Exploit Prediction Scoring System) score say whether a flaw is being exploited or is likely to be, and that is what actually sorts a queue of ten thousand alerts. The cyber application asks how often scans run, how fast critical internet-facing flaws get fixed, sometimes how many critical flaws have been open for more than thirty days. The underwriter checks the answer against its own external scan: a known flaw on an exposed VPN or mail server outweighs anything declared on the form. Some policies add an unpatched vulnerability exclusion, or an insured share that grows with the age of the flaw. The practitioner's caveat: the best program does nothing against a zero-day. MOVEit was exploited in 2023 before any patch existed, and the only thing that set companies apart was how fast they moved once the flaw went public.