# Vulnerability Management

> <!-- Copyright (c) 2026 defconxt. All rights reserved. -->

- Skill: `majiayu000/vulnerability-management-4` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add majiayu000/vulnerability-management-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/vulnerability-management-4/raw
- Safety review: pending (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/vulnerability-management-4

---


<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: vulnerability-management
description: >-
  Vulnerability management lifecycle including asset discovery, vulnerability scanning
  (Nessus/Qualys/OpenVAS), prioritization (CVSS/EPSS/SSVC/KEV), patch management,
  remediation tracking, exception management, vulnerability disclosure programs,
  and vulnerability metrics/reporting.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - vulnerability-management
  - scanning
  - cvss
  - epss
  - patch-management
  - nessus
  - qualys
  - remediation
  - kev
  - ssvc
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1190", "T1210", "T1068"]
  nist-csf: ["ID.RA-1", "ID.RA-5", "PR.IP-12", "RS.MI-3"]
  frameworks: ["SSVC", "CISA KEV", "FIRST CVSS v4.0", "FIRST EPSS"]
---

# Vulnerability Management

## When to Use

Activate when the operator asks about vulnerability scanning, patch management,
CVSS scoring, vulnerability prioritization, remediation SLAs, exception management,
or vulnerability program metrics.

Mode: `[MODE: BLUE]` for VM operations; `[MODE: ARCHITECT]` for VM program design.

## Quick Reference

| Priority | CVSS | EPSS | CISA KEV | SLA |
|----------|------|------|----------|-----|
| Critical | 9.0-10.0 | >0.5 | Yes | 24-48 hours |
| High | 7.0-8.9 | >0.1 | No | 7 days |
| Medium | 4.0-6.9 | <0.1 | No | 30 days |
| Low | 0.1-3.9 | <0.01 | No | 90 days |

## Workflow

### 1. Vulnerability Prioritization (Beyond CVSS)

```
CVSS alone is insufficient. Use multi-factor prioritization:

1. CVSS v4.0 Base Score — theoretical severity
2. EPSS Score — probability of exploitation in next 30 days
3. CISA KEV Catalog — confirmed actively exploited
4. SSVC Decision Tree — Stakeholder-Specific Vulnerability Categorization
   ├── Exploitation: None / PoC / Active
   ├── Exposure: Small / Controlled / Open
   ├── Utility: Laborious / Efficient / Automatable
   ├── Impact: Low / Medium / High
   └── Decision: Defer / Scheduled / Out-of-cycle / Immediate

Priority matrix:
├── CISA KEV = Immediate (regardless of CVSS)
├── EPSS > 0.5 + CVSS ≥ 7.0 = Immediate
├── EPSS > 0.1 + Internet-facing = Out-of-cycle
├── CVSS ≥ 9.0 + No compensating controls = Out-of-cycle
└── Everything else = Scheduled based on CVSS

# Query EPSS API
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-1234" | jq '.data[0]'

# Query CISA KEV
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | \
  jq '.vulnerabilities[] | select(.cveID=="CVE-2024-1234")'
```

### 2. Scanning Strategy

```bash
# Network scanning (OpenVAS/Greenbone)
gvm-cli socket --socketpath /run/gvmd.sock --xml \
  "<create_target><name>Internal Scan</name><hosts>10.0.0.0/24</hosts></create_target>"

# Authenticated scanning (more accurate)
# Windows: Domain credential or local admin
# Linux: SSH key-based authentication
# Web apps: Authenticated scanning with session tokens

# Scan scheduling:
# Internal servers: Weekly authenticated scan
# Internet-facing: Daily unauthenticated + weekly authenticated
# Development: On-commit (SAST/SCA), weekly infrastructure
# Cloud: Continuous (CSPM) + weekly agent-based

# Coverage metrics:
# Asset coverage: % of known assets with recent scan (<7 days)
# Scan success rate: % of scans completing without errors
# Authentication rate: % of scans with valid credentials
```

### 3. Remediation Workflow

```
Vulnerability lifecycle:
1. Discovery — Scanner identifies vulnerability
2. Validation — Confirm (not false positive), determine exploitability
3. Prioritization — CVSS + EPSS + KEV + business context
4. Assignment — Route to system/app owner
5. Remediation — Patch, upgrade, config change, or compensating control
6. Verification — Rescan to confirm fix
7. Closure — Document resolution, update tracking

Exception management:
├── Risk acceptance: Business owner signs off, time-limited (90 days max)
├── Compensating control: WAF rule, network segmentation, monitoring
├── False positive: Document evidence, suppress in scanner
└── Deferred: Scheduled for next maintenance window, within SLA

SLA enforcement:
├── Auto-escalation: Notify manager at 75% SLA
├── Auto-escalation: Notify CISO at 100% SLA
├── Dashboard: Real-time SLA compliance visibility
└── Exception: Requires VP+ approval, max 90-day extension
```

### 4. Metrics & Reporting

```
Operational metrics:
├── Mean Time to Remediate (MTTR) by severity
├── SLA compliance rate (% remediated within SLA)
├── Open vulnerability count by severity (trend)
├── Vulnerability density (vulns per asset)
├── Scan coverage (% assets scanned in last 7 days)
├── Recurrence rate (vulns that reappear after remediation)
└── Exception count and aging

Executive metrics:
├── Risk reduction trend (critical+high over time)
├── SLA compliance by business unit
├── Top 10 riskiest assets
├── Patch compliance rate
└── Comparison to industry benchmarks
```

## Verification

- [ ] All assets in inventory have recent vulnerability scan (<7 days)
- [ ] CISA KEV vulnerabilities remediated within 48 hours
- [ ] EPSS >0.5 vulnerabilities prioritized for immediate remediation
- [ ] Remediation SLAs defined and enforced by severity
- [ ] Exception process requires business owner sign-off
- [ ] Metrics dashboard reporting MTTR and SLA compliance
- [ ] Vulnerability disclosure program (VDP) published