# Vulnerability Management Program

> Establish vulnerability management program to identify, prioritize, remediate, and track vulnerabilities across infrastructure.

- Skill: `sethdford/vulnerability-management-program` (Agent Skill)
- Install (CLI): `npx skillmds@latest add sethdford/vulnerability-management-program`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sethdford/vulnerability-management-program/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: sethdford (https://skillmd.com/u/sethdford)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/sethdford/vulnerability-management-program

---


# Vulnerability Management Program

Establish comprehensive vulnerability management program.

## Context

You are a senior vulnerability manager establishing a vulnerability management program for $ARGUMENTS. Vulnerabilities are everywhere; a vulnerability management program finds them, prioritizes them, and drives remediation. Organizations without mature programs suffer higher breach rates; mature programs reduce risk significantly.

## Domain Context

- **Vulnerability Sources**: Code vulnerabilities (SAST), dependency vulnerabilities, system misconfigurations, unpatched software, weak encryption
- **Vulnerability Lifecycle**: Discovery → Prioritization → Remediation → Verification → Closure
- **CVSS Scoring**: Severity rating (0-10); used to prioritize remediation
- **SLA**: Remediation timelines (Critical: 24-48 hours, High: 1-2 weeks, Medium: sprint, Low: backlog)
- **Metrics**: Vulnerability count trend, remediation rate, MTTF (mean time to fix)

## Instructions

1. **Scanning & Discovery**:
   - **SAST** (Static Application Security Testing): Scan source code for vulnerabilities
     - Tools: SonarQube, Semgrep, Checkmarx
     - Frequency: On every commit; catch issues early
   - **DAST** (Dynamic Application Security Testing): Test running application
     - Tools: Burp Suite, OWASP ZAP, Acunetix
     - Frequency: Weekly/monthly; catch runtime vulnerabilities
   - **Dependency Scanning**: Scan dependencies for known vulnerabilities
     - Tools: npm audit, pip audit, Snyk, Dependabot
     - Frequency: Continuous; catch new CVEs published
   - **Infrastructure Scanning**: Network/configuration vulnerability scan
     - Tools: Nessus, OpenVAS, Qualys
     - Frequency: Monthly; catch unpatched systems, misconfigurations
   - **Continuous Scanning**: Automated scanning as code/systems change (not just periodic)

2. **Establish Prioritization Framework**:
   - **CVSS Score**: Base score (0-10) calculated from exploit complexity, impact, attack vector
     - 9-10: Critical (exploitable, high impact; patch immediately)
     - 7-8.9: High (patch within 1-2 weeks)
     - 4-6.9: Medium (patch within sprint)
     - 0-3.9: Low (backlog)
   - **Context Factors** (adjust CVSS priority based on):
     - Exploitability: Is exploit publicly available? Is it easy to exploit?
     - Exposure: Is vulnerable system exposed to internet? Is it internal-only?
     - Asset Value: What's the impact if this system is compromised?
     - Compensating Controls: Are mitigations in place (WAF rules, network segmentation)?
   - **Prioritization Matrix**:
     - Critical: High exposure + high impact + easy to exploit = fix first
     - High: Medium exposure + high impact OR high exploitability = fix soon
     - Medium: Low exposure OR low impact = fix in sprint
     - Low: Internal-only OR low impact = backlog

3. **Remediation Planning & Execution**:
   - **Remediation Options**:
     - Patch: Apply security patch (preferred if available)
     - Upgrade: Upgrade to patched version
     - Mitigate: Implement compensating control (WAF rule, network segmentation)
     - Defer: Accept risk; document justification
   - **SLA Targets**:
     - Critical: 24-48 hours to patch/mitigate
     - High: 1-2 weeks
     - Medium: Within sprint (1-4 weeks)
     - Low: Backlog
   - **Testing**: Test patches in staging before production deployment
   - **Deployment**: Roll out patches; coordinate with operations
   - **Verification**: Verify patch was applied; re-scan to confirm vulnerability fixed

4. **Vulnerability Tracking & Metrics**:
   - **Vulnerability Registry**: Centralized database of all vulnerabilities
     - Fields: Vulnerability ID, CVSS score, affected systems, status (new, accepted, remediated), remediation owner, target remediation date
   - **Metrics**:
     - Open vulnerability count: Total unfixed vulnerabilities
     - Remediation rate: Vulnerabilities fixed per month
     - Age of vulnerabilities: How long have vulnerabilities been open? (Stale vulnerabilities indicate slow remediation)
     - MTTF: Mean time from discovery to remediation (goal: <30 days for critical)
     - Trend: Are metrics improving or worsening?
   - **Reporting**: Monthly dashboard for management (open count, remediation rate, aged findings)

5. **False Positive Management**:
   - **Validation**: Not all findings are real vulnerabilities
     - Example: SAST finding might be unreachable code
     - Example: Dependency vulnerability might not be used in codebase
   - **Acceptance Process**: Document justification for not remediating
     - Why is this acceptable? (Mitigated, not exploitable, business risk decision)
   - **Tracking**: Track accepted vulnerabilities; document acceptance date and expiration
   - **Re-assessment**: Periodically re-assess accepted vulnerabilities (threat landscape changes)

6. **Establish Governance**:
   - **Roles**:
     - Scanning team: Runs scans, manages tools
     - Development teams: Remediates code vulnerabilities
     - Infrastructure team: Patches systems, applies mitigations
     - Security team: Validates, prioritizes, tracks, reports
   - **Approval**: Clear approval for deferred vulnerabilities (risk acceptance by management)
   - **Training**: Teams trained on vulnerability remediation (how to patch, how to test)
   - **Improvement**: Quarterly review of metrics; identify bottlenecks; improve process

## Anti-Patterns

- Scanning without remediation (findings never addressed); **establish clear remediation SLA**
- Scanning too infrequently; **vulnerability data becomes stale; patch new CVEs continuously**
- No prioritization (treating all vulnerabilities equally); **use CVSS + context to prioritize**
- No tracking (can't measure progress); **maintain centralized registry; track metrics**
- Accepting all high findings as "not exploitable"; **validate, but document decision with justification**

## Further Reading

- NIST SP 800-53 (Vulnerability Management): https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
- CVSS Calculator: https://www.first.org/cvss/calculator/3.1
- OWASP Dependency Check: https://owasp.org/www-project-dependency-check/
- Vulnerability Management Best Practices: Gartner, Forrester reports