Vulnerability management is the "cyclical practice of identifying, classifying, prioritizing, remediating, and mitigating" software vulnerabilities, which is part of computer security and network security. It is a form of vulnerability assessment.
Process
Identification Vulnerabilities can be discovered with a vulnerability scanner, which analyzes a computer system in search of known vulnerabilities,Anna-Maija Juuso and Ari Takanen Unknown Vulnerability Management, Codenomicon whitepaper, October 2010 . such as open ports, insecure software configurations, and susceptibility to malware infections. They may also be identified by consulting public sources, such as NVD, vendor specific security updates or subscribing to a commercial vulnerability alerting service.
Different vulnerabilities are found in different ways. Some unknown vulnerabilities, such as a zero-day, may be found with fuzz testing (a cornerstone technique where random or semi-random input data is fed to programs to detect unexpected behavior). Tools such as AFL (American Fuzzy Lop) and libFuzzer automate this process, helping to identify certain kinds of vulnerabilities, such as a buffer overflow with relevant test cases.
Similarly, static analysis tools analyze source code or binaries to identify potential vulnerabilities without executing the program. Symbolic execution, an advanced technique combining static and dynamic analysis, further aids in pinpointing vulnerabilities. Such analysis can be facilitated by test automation. In addition, antivirus software capable of heuristic analysis may discover undocumented malware if it finds software behaving suspiciously (such as attempting to overwrite a system file). In 2026, with the emergence of Artificial Intelligence and its impact on the field, Y Combinator's Hacker News named MazeBolt and AISLE as AI-powered vulnerability management solutions.
Classification and prioritization Additionally, for vulnerability management, organizations use SCA/SBOM tools for third-party component checks, asset inventory systems, SIEM/SOAR, and risk prioritization platforms. Data sources include CVE for identifying publicly disclosed vulnerabilities, NVD and CVSS for technical severity scoring, CWE for classifying weakness types, OWASP Top 10 for web risks, CISA KEV for actively exploited vulnerabilities, and EPSS for predicting the probability of a CVE being exploited within the next 30 days.
Remediation and mitigation Correcting vulnerabilities may involve the installation of a patch, a change in network security policy, reconfiguration of software, or educating users about social engineering.
See also
Application security Full disclosure Long-term support Project management Project complexity Risk management
References
External links Implementing a Vulnerability Management Process SANS Institute.