Vulnerability Management Program & Automation
A scanner tells you what it found. A program tells you what's being fixed, by whom, by when, and what the scanner couldn't see. I build that program from the ground up, or rescue the one you have, and automate the parts your team does by hand.
Who this is for
- Organizations that just bought a scanner and haven't started, or set up the basics and don't know where to go next.
- Enterprise VM teams whose program has stalled: queues too large to work, owners nobody trusts, metrics leadership has stopped reading.
- Mid-market IT and security leads with a scanner license and a spreadsheet, who need a program that runs without a full-time analyst.
- Organizations facing an audit or assessment that need the program to produce evidence as a side effect (see Compliance Evidence).
I've built and run programs for environments from 200 hosts to more than 400,000.
Where it starts: an assessment
If you don't know where you stand, start here. I review the environment and any scanning you already have: what's in scope, whether scans authenticate, and what they miss. You get a prioritized picture of what's exposed, the hosts and networks that weren't assessed and why, and a plan for the program. This is scan-based work: I don't exploit anything. It often stands on its own as a short engagement.
How a program build runs
1. Architecture and coverage
- Scan engine placement: which engines cover which networks, sites and cloud accounts, and the firewall access each one needs.
- Scan load and scheduling across the full inventory, so scans finish inside agreed windows.
- Scope that follows your inventory (CMDB, directory, EDR, cloud accounts) instead of a fixed list, so new subnets and hosts are picked up.
- Asset groups and tags by owner, environment and criticality, which everything downstream depends on.
2. Credentialed scanning
- Service accounts and privileges for Windows, Linux/Unix and network devices, with credentials stored and rotated safely.
- Authentication reporting: success rates, failures and hosts that flipped, reviewed every cycle.
- Working the failures through with the teams that own the systems until authenticated coverage is where it should be.
- Scan policies tuned to each asset class.
3. Prioritization and remediation
- Priorities from exploitability (CISA KEV, EPSS), exposure and asset criticality, not raw CVSS.
- Ticketing integration with Jira, ServiceNow, Zendesk or a custom build: findings deduplicated, routed to the right owner, with SLA clocks and reopen logic.
- SLAs written with, and accepted by, the teams held to them.
- An exception process with owners, compensating controls and expiry dates.
- Rescan verification before a ticket closes.
4. Reporting
- Dashboards and reports for analysts, system owners and leadership, each with the question it answers and how it's calculated.
- Time-to-remediate, aging and SLA performance by severity and owner.
- Coverage next to findings in the same report: what wasn't scanned, wasn't authenticated, or is stale.
5. Automation
- Scope that updates as the inventory changes, and new hosts that get their credentials tested and configured automatically.
- Scanner operations that would otherwise be manual, built in your environment, under your accounts and your source control.
6. Documentation, training and handoff
- Runbooks and documentation for every recurring task.
- Training for the analysts and system owners who'll use it.
- Then either your staff take the program over, or I stay on to run it, on my own or overseeing staff or contract analysts.
Scanners I work with: InsightVM/Nexpose, Nessus/Tenable, Qualys, OpenVAS, Wiz, CrowdStrike Falcon and Microsoft Defender Vulnerability Management.
Timeline
It depends on the size of the environment; the written scope gives the timeline. Larger estates may run as phases, or as a retainer after the build.
What a sample output looks like
A coverage report that lists, per asset group: assets in inventory, assets scanned, assets authenticated, and assets not assessed with the reason for each, beside open findings by SLA status.