Click image to view it in full size

The Vulnerability Management Market holds true to four foundational principles while simultaneously building new complementary functionality and creating partnerships that leverage the advances in data analytics and cloud networking. The four principles are: (1) identify vulnerabilities (discovery), (2) prioritize based on severity and risk, (3) communicate vulnerability status and risk to all relevant parties (reporting), and (4) recommend proper a response.

A company should not set goals to patch all known vulnerability , or even all zero-day vulnerabilities as they are published on the internet. The goal should be to patch the threats that could be exploited against your company. Trying to patch everything is a trap too many companies fall into, costing a lot of time and resources as a result of prioritizing the wrong vulnerabilities to patch. Risk and threat intelligence play a crucial role in prioritization, companies need to keep in mind that zero day vulnerabilities need to be analyzed, but there are many known vulnerabilities that don’t require immediate action.

A vulnerability management platform should provide a picture of a client’s security posture correlating the assets of the client organization, classifying their importance with the vulnerabilities identified in the scan. After detecting a vulnerability, Vulnerability Management players must provide detailed information for remediation, including when the vulnerability was published and its description as well as when the patch was published. The notification can be done via email or ticketing system.