Solution
Vulnerability and exposure management
Vulnerability and exposure management is the work of finding weaknesses, deciding which ones matter, and fixing them quickly. The hard part is rarely finding them. It is merging many lists, ranking by real risk, and getting fixes deployed.
More findings than fixes
Each scanner has its own list. The same flaw appears several times, severity scores ignore whether an exploit exists, and patching waits on tickets and maintenance windows. Auditors then ask for evidence that the process works.
What good looks like
- One consolidated record across scanners and teams.
- Ranking that uses exploit data such as EPSS and the CISA Known Exploited Vulnerabilities list.
- Remediation SLAs that are measured, not estimated.
- Automated patching with verification.
- Documented risk acceptance for what cannot be fixed.
Vendors that deliver this through Evanssion
| Vendor | Role in this solution |
|---|---|
| DefectDojo | Consolidation, de-duplication, risk ranking and workflow for findings from 500+ tools |
Questions to ask when choosing a solution
- Does it rank by exploitability as well as severity?
- Does it connect to our ticketing and patching tools?
- Can it verify that a patch was applied?
- What reporting do auditors get?
Frequently asked questions
What is risk-based vulnerability management?
It ranks vulnerabilities by the likelihood and impact of real attacks, using exploit data and asset importance, rather than by severity score alone.
What are EPSS and CISA KEV?
The Exploit Prediction Scoring System estimates the probability that a vulnerability will be exploited. The CISA Known Exploited Vulnerabilities catalogue lists flaws that are being exploited now.
Should patching be automatic?
For most endpoint and third-party software, yes, within policy and approved windows. Critical servers often need change control.