Vulnerability Management

What is vulnerability management?

Vulnerability management is the continuous process of finding weaknesses across an estate, assessing how serious each one is, prioritising the ones worth acting on, remediating them, and verifying that the fix held. It is a programme rather than a scan. The scan is one step inside it.

A classic vulnerability management tool does the first two steps well. It keeps an inventory, correlates what it sees against a CVE database, assigns a severity score, and hands your team a ranked list. That list is usually accurate. It is also usually far longer than the remediation capacity available to work through it, and nothing in it tells you which entries an attacker could actually reach.

PentestOps runs the same lifecycle with one addition that changes the shape of the output. Before a finding is ranked, it is tested. Safe, scope-gated exploitation establishes whether the weakness is reachable and usable on the asset it was found on, so priority reflects proof instead of assumption.

• Detection answers a narrow question: is this weakness present on this asset?
• Assessment answers a second one: how severe is this class of defect in the abstract?
• Validation answers the question that decides your week: could an attacker actually reach and use it here, given the network position and the controls already in place?
• Classic vulnerability management stops after the first two. PentestOps adds the third before anything is prioritised.

Detection and scoring are not a priority list

Most security teams are not short of findings. They are short of a defensible way to choose between them. An unvalidated backlog produces two predictable failure modes: teams chase everything and burn remediation capacity on issues that were never reachable, or they lose confidence in the list and stop reading it. Neither reduces risk.

The underlying reason is that a severity score describes a defect, not your environment. It cannot know whether the vulnerable code path is exposed, whether a segmentation rule already blocks the route to it, or whether a low-scoring credential weakness three hops away turns a moderate issue into a straight line to a domain controller.

Validation collapses that uncertainty. On PentestOps, exploitation runs only under a signed Rules of Engagement, with scope enforcement that automatically stops activity outside authorised assets, and a strategy engine that selects the technique per finding. Every action is captured as evidence. The result is the difference between a finding and a proven exposure, which is set out in more depth in attack path validation.

The vulnerability management lifecycle on PentestOps

The five stages below are the standard lifecycle. What differs is what happens at each one, and how much is left for a human to work out afterwards.

How findings are scored and ranked

Ranking uses several independent signals rather than one number, because no single signal survives contact with a real estate.

Severity comes from CVSS v3.1, maintained by FIRST, which gives every finding a comparable base score. FIRST also publishes EPSS, which models the likelihood that a vulnerability will be exploited in the wild. Both are useful population-level signals, and both describe the vulnerability rather than your instance of it. PentestOps takes the more direct route on assets that are in scope: it attempts the exploitation, safely, and records what happened.

Known real-world abuse is treated as its own tier. Findings are checked against the CISA Known Exploited Vulnerabilities catalogue, the authoritative list of vulnerabilities with confirmed active exploitation. A KEV match on an internet-facing asset outranks a higher-scoring issue that nobody has ever been observed using.

• CVE correlation identifies the known defect behind the finding.
• CVSS v3.1 supplies a consistent severity baseline across every asset class.
• Exploit availability flags whether working exploitation is known to exist for the issue.
• CISA KEV promotes vulnerabilities with confirmed real-world exploitation.
• Validated exploitability confirms whether the route works on your asset, in your network position.
• AI business impact analysis weighs what the affected asset is worth to the organisation, using self-hosted AI by default.
• False-positive reduction runs ahead of all of it, so the ranked list is short enough to be actioned.

Vulnerability management is a trend, not a snapshot

A single assessment tells you the state of the estate on one day. A programme needs the delta: what is new, what was fixed, what is still open past its agreed window, and what came back after someone rebuilt a host from an old image.

Scan comparison puts consecutive assessments side by side so those four categories are explicit rather than inferred. Asset drift detection maintains a full change ledger, with alerts on new and missing hosts, and 7-day asset re-verification keeps the inventory from quietly going stale between scans. On Enterprise, continuous monitoring adds agentless EASM re-checks of the perimeter between scheduled assessments.

Run that way, vulnerability management stops being an annual event and becomes the reporting layer over continuous penetration testing. The broader programme framing, including how exposures are scoped and mobilised, is covered under exposure management.

When a dedicated VM suite is still the better fit

PentestOps is not trying to be an endpoint agent fleet, and it is worth being clear about where that boundary sits.

The on-premise agent is a network-side deployment. It installs in about 5 minutes, needs 0 inbound firewall rules, connects outbound-only over TLS, and one host can cover multiple subnets. That design is deliberate: it gives internal reach without putting software on every machine. What it does not give you is per-host patch telemetry from an agent sitting on each laptop, workstation and server.

So if your priority is agent-based endpoint coverage at scale, with continuous patch-state reporting per device and deep integration into an existing patch-management workflow, a dedicated enterprise vulnerability management suite is built for that and PentestOps is not a like-for-like replacement. The trade-offs are laid out in PentestOps vs Qualys and PentestOps vs Nessus.

Plenty of organisations run both, and that is a reasonable architecture. Keep the suite for breadth of endpoint patch telemetry; use PentestOps to work out which of those thousands of findings an attacker could actually use, and to prove it.

Why PentestOps

• Validation before prioritisation: safe, RoE-gated exploitation with a full evidence trail, so the ranked list is backed by proof rather than severity alone.
• One lifecycle on one platform. Discovery, assessment, prioritisation, remediation guidance and verification all run against the same inventory and the same 7-phase methodology.
• Coverage across external perimeter, internal networks, web applications, APIs, cloud and identity, with 800+ automated cloud checks across AWS, Azure, GCP and M365.
• Self-hosted AI by default drives risk scoring and remediation guidance without sending scan data to third-party model providers; external providers are opt-in per tenant.
• Findings map to 8 compliance reporting frameworks (OWASP Top 10, PCI DSS v4.0, NIST 800-53, SOC 2, HIPAA, GDPR, ISO 27001, SMB1001) plus CIS Benchmarks for AWS, Azure, GCP and Kubernetes.
• Asset-wise pricing: you pay for the assets in scope, and scans against them are unlimited within fair use, so re-testing a fix never costs you anything extra.
• Australian-built and operated. The platform is hosted in Australia, customer data is stored in Australia, and Extranet Systems Pty Ltd is ISO/IEC 27001:2022 certified.