Vulnerability management process: 6 steps for your business

For the first time in the 19 years Verizon has published its Data Breach Investigations Report, exploiting a software vulnerability has overtaken stolen passwords as the most common way attackers get in. In the 2026 report it accounted for 31% of breaches, and the median time organizations took to fully patch actively exploited vulnerabilities grew to 43 days. A working vulnerability management process is how you close that gap.

The process is simple to describe. You keep track of what you have, find its weaknesses, fix the ones that matter most and prove you did it. A small office with an outdated firewall or an unpatched remote-access server is exactly what automated attack tools look for, so this applies at 15 staff as much as at 1,500.

What vulnerability management means

A vulnerability is a weakness an attacker can use: a bug in software or firmware, a missing patch, a default password or a risky setting. When a breach “started with an exploit,” someone used one of these weaknesses to run code, raise their privileges or get into a system.

Vulnerability management is the ongoing cycle of finding those weaknesses, deciding which to fix first, fixing them and checking that the fix worked. A vulnerability assessment is one point-in-time step inside that cycle.

Why the vulnerability management process can’t wait

The volume of new flaws keeps rising, and attackers move faster than most patch cycles.

Verizon’s 2026 DBIR found that only 26% of the vulnerabilities on CISA’s Known Exploited Vulnerabilities list had been fully fixed by the organizations it studied, down from 38% a year earlier.

Network edge devices carry much of the risk. In February 2026, CISA ordered federal agencies to inventory and replace firewalls, routers and other edge devices that no longer receive security updates, and encouraged all network defenders to follow the same guidance. If your firewall or VPN appliance is past end of support, no patch is coming, and replacing it belongs in your IT refresh plan.

The 6-step vulnerability management process

1. Know what you have

Inventory every device and service that touches company data: workstations, laptops, servers, phones, firewalls, switches, Wi-Fi access points, printers, cameras and cloud services such as Microsoft 365. Record the model, software and firmware versions, and end-of-support date for each. Anything missing from the list never gets scanned.

2. Scan and assess

Scan everything in the inventory from inside your network and from the internet. Authenticated scans, which log in to each system, find far more than a scan that only looks from the outside.

3. Rank by real-world risk

Even a small network can return hundreds of findings. Use more than one signal to sort them:

• Anything on CISA’s Known Exploited Vulnerabilities catalog goes to the top.
• FIRST’s free Exploit Prediction Scoring System (EPSS) estimates the probability a vulnerability will be exploited in the next 30 days.
• The Common Vulnerability Scoring System (CVSS) rates technical severity from 0 to 10, with 9.0 and above rated critical. It measures severity, not your risk, so don’t use it alone.
• Internet-facing systems and devices holding client, patient or financial data come before an isolated workstation.

4. Fix it

Most fixes are a patch or a firmware update. When no patch exists, or the device is too old to get one, you can change a setting, disable the vulnerable feature, isolate the device on its own network segment, block the application, or replace the device. Test critical patches first, but set a deadline. A fix that waits for a convenient time often never happens.

5. Verify and document

Rescan to confirm each fix worked. Record what was found, when, what you did, and any risk you chose to accept and why. That record is the evidence auditors, insurers and regulators ask for.

6. Repeat

Scan continuously or at least monthly, and again after major changes such as a new firewall, server or software rollout. Review end-of-support dates at least once a year.

Where assessments and penetration tests fit

A good vulnerability assessment follows a clear sequence: agree on scope, discover every device (including ones nobody knew about), run internal and external scans, weed out false positives, deliver a report ranked by real-world risk that an owner can act on, then fix the top items and rescan.

A penetration test goes further. A tester actively tries to break in and chain weaknesses together. When a client needs one, we quote the penetration test and run it along with an annual vulnerability assessment, so the tester spends time on real attack paths instead of missing patches. Our post on pen tests vs. vulnerability tests covers when you need each.

What regulators and insurers expect

• The FTC Safeguards Rule requires covered financial businesses, including many tax, accounting and lending firms, to regularly test their safeguards. For information systems that means continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months and after material changes.
• The current HIPAA Security Rule requires an accurate and thorough risk analysis of risks and vulnerabilities to electronic protected health information. A proposed update published in January 2025 would add vulnerability scanning at least every six months, penetration testing at least every 12 months, and a yearly asset inventory and network map. As of mid-2026 it had not been finalized.
• Cyber insurance applications commonly ask how you patch and whether you scan, especially internet-facing systems.

Even where no rule names a schedule, a documented scan, fix and verify cycle is one of the clearest ways to show reasonable security. See how we support healthcare practices and accounting and financial firms with these requirements, and how our compliance services keep the records.

Find out when your firewall last got a firmware update, and whether it still gets them. Then book an intro call and we’ll talk through where vulnerability management fits in your cybersecurity program.

Sources: Verizon 2026 Data Breach Investigations Report; Help Net Security: Verizon 2026 DBIR findings, May 2026; Jerry Gamblin: 2025 CVE data review, January 2026; BleepingComputer: CISA orders federal agencies to replace end-of-life edge devices (BOD 26-02), February 2026; FIRST: Exploit Prediction Scoring System (EPSS); FIRST: CVSS v4.0 specification; eCFR: 16 CFR 314.4, FTC Safeguards Rule elements; eCFR: 45 CFR 164.308, HIPAA administrative safeguards; HHS: HIPAA Security Rule NPRM fact sheet; Medcurity: HIPAA Security Rule 2026 status, June 2026.