Vulnerability Management: Finding the Holes Before Someone Else Does

Patch management is the fixing half of a discipline whose finding half most small businesses skip: vulnerability management — systematically discovering where you’re exposed, before relying on the fix pipeline to close it. The two get conflated (“we patch, so we’re covered”), and the gap between them is precisely where surprises live: the system the patch cycle doesn’t know about, the misconfiguration no patch exists for, the service accidentally facing the internet. Here’s the finding half, sized for a small business.

Why patching alone leaves gaps

Patching fixes known flaws on known systems via known update channels — three “knowns,” each with leaks. Unknown systems: the machine that never joined the inventory receives no patches and no attention, indefinitely. Non-patch weaknesses: default credentials on the camera system, an exposed management interface, a share open to everyone, TLS from a previous decade — real vulnerabilities with no update to install. Verification gaps: the patch that deployed but didn’t apply, the “protected” machine the agent fell off of. Vulnerability management is the practice of looking — with tools that check your actual systems against the catalog of known weaknesses — rather than inferring safety from process compliance.

The two views: outside-in and inside-out

The external scan — the attacker’s view. What does your business look like from the internet? Exposed services, open ports, the forgotten remote-access hole, certificate and mail-security posture. This is the scan attackers run against everyone constantly and some insurers now run before quoting you — so running it on yourself first is just reading your own mail before the adversary does. It’s also the cheapest scan to obtain and the one with the highest stakes per finding: anything wrong in the external view is reachable by the whole planet.

The internal scan — the blast-radius view. Authenticated scanning across the inside: unpatched software the cycle missed, end-of-life stragglers, weak configurations, default credentials. Findings here answer a different question — not “can they get in?” but “once in, what’s soft?” — which is what determines whether an intrusion becomes an incident. Modern EDR and management platforms increasingly include this visibility natively; many businesses own the capability unread.

Prioritization: the skill that makes it manageable

The first real scan produces a demoralizing list — hundreds of findings — and the discipline that makes the practice sustainable is refusing to treat them equally. The triage that matters, in order: actively-exploited-in-the-wild beats severity scores — a “medium” flaw attackers are currently using (CISA’s Known Exploited Vulnerabilities list is the free, authoritative feed) outranks a theoretical “critical,” and gets the fast-lane treatment · exposure multiplies urgency — the same flaw on the internet-facing firewall versus a segmented internal box are different emergencies · crown-jewel adjacency counts — findings on the systems that hold Restricted data or run production jump the queue · and the residue becomes managed backlog: fixed on the normal cycle, or consciously excepted with compensating controls. The output worth reporting: not the raw count, but time-to-fix on the exploited-and-exposed tier — the metric that belongs beside patch latency on the leadership page.

The right-sized rhythm

For a small business: external scan quarterly (and after any perimeter change), internal visibility continuous via the platforms you own, findings triaged monthly into the patch-and-fix pipeline, and an annual deeper look — a proper vulnerability assessment, or a penetration test where compliance or stakes warrant one (the distinction: a scan finds known weaknesses; a pentest pays a human to chain them the way an attacker would — valuable, and only meaningful after the scan-level hygiene is handled). In a managed security relationship, scanning and triage should be part of the fabric — one more thing to verify with a quarterly question: when was our last external scan, and what’s open on the exploited-in-the-wild list?

The bottom line

Patching closes the holes you know about; vulnerability management is how you come to know about them: the attacker’s-view scan quarterly, continuous internal visibility, triage that ranks exploited-and-exposed above everything, and the residue managed rather than ignored. It converts your exposure from a hopeful inference into a read report — and the difference between those two is usually discovered by whoever scans first. Make sure that’s you.