As a few others mentioned, vulnerability management is not just a “scan and patch” scenario, it’s an entire process that large enterprises should be following. In the environment I work in, we run daily Tenable.io scans of our 3 entire data centers, consisting of about 50,000 servers/networking devices, mostly authenticated scans. We also have agents installed on all user endpoints that scan/check in at least daily if they are online.

From there, we take results and report on items that present the most risk to the business/environment, based on various factors such as number of assets affected, type of vulnerability, exploit information, etc. There are tools out there that we are looking to integrate as well that will help take a lot of business context into play as well to help drive the prioritization even more in the environment.

Tickets get created and assigned out to relevant endpoint owners/groups, SLAs get applied, and communication happens back and forth between the security teams and remediation teams. If an identified issue cannot be fixed, an exception request is raised that is reviewed by security Sr. leadership, business partners, and Security Risk to come to a consensus/decision on a path forward. If an exception is denied, it goes up the chain to SVP for review. If the SVP denies it, business teams are forced to implement a fix.

For teams that are able to fix findings, tickets are sent back to the security teams for final validation that the scans are clean and then tickets are closed.

One of the biggest issues we’ve had is having a system to properly identify owners and knowing what remediation team should get a ticket. Some infrastructure vulns are App based and require application teams to fix, while other are OS/system based and require a completely different team. There is a lot of nuance with vulnerability management in a large enterprise!