Many successful attacks on companies start not with a new, unknown virus but with a long-published yet unpatched vulnerability: an outdated VPN appliance, a forgotten test server or a website running an old plugin. An antivirus does not close such gaps – it protects against malware, but not against the system itself leaving the door open.
Vulnerability management is a continuous process in which a company finds the weak spots in its systems, assesses how dangerous they are and removes them before attackers can exploit them. In this article we explain what such a process looks like in practice and where to start.
How vulnerability management differs from antivirus protection
- Antivirus or EPP protection reacts to malicious activity once it is already happening on a device.
- Vulnerability management works earlier – it looks for gaps that malicious activity could exploit.
- The former protects endpoints, the latter also covers servers, network devices, websites, APIs and cloud services.
- The two layers complement each other, which is why NIS2 and other requirements usually call for both.
The vulnerability management cycle
A working process is not a one-off check but a recurring cycle:
- Inventory. List all devices, servers, applications, domains and publicly accessible services. Systems that are not listed will not be checked.
- Scanning. Check systems regularly with automated tools – both on the internal network and from the internet side.
- Priorities. Assess the vulnerabilities found by severity, the importance of the system and whether the vulnerability is already being actively exploited.
- Remediation. Install patches, change the configuration or, if no patch is available yet, apply temporary safeguards.
- Verification. Rescan and make sure the vulnerability has really been removed.
- Reporting. Record what was found and what was fixed – this matters both for management and for compliance audits. Then the cycle starts again, because new vulnerabilities are published every month.
Setting priorities is the most important step of the cycle. The first scan often shows hundreds of findings, and trying to fix everything at once ends with nothing being fixed. Start with vulnerabilities that are in publicly accessible systems, have a high severity rating, for example on the CVSS scale, and are already being actively exploited by attackers. Less critical vulnerabilities in internal systems can be scheduled for regular updates.
The external attack surface – what the attacker sees
A large part of the risk lies not in the internal network but in what is reachable from the internet: websites, customer portals, APIs, mail and remote access servers, forgotten subdomains. Companies often do not even know all their publicly accessible assets, especially when they were built by different suppliers or departments.
- External attack surface monitoring helps find unknown or forgotten assets.
- Automated scanning of websites and APIs detects the most common vulnerabilities between periodic tests.
- A penetration test carried out by specialists shows how vulnerabilities can actually be exploited.
- Mobile app testing is important for companies that provide their own apps to customers.
It is also important that the external picture changes constantly. A new version of the website is released, a port is opened for remote work, a supplier installs a test environment – and a new entry point appears that did not exist yesterday. That is why a one-off check once a year gives only a snapshot, while continuous monitoring lets you notice changes immediately.
Patch management – the most often forgotten step
Finding a vulnerability is easier than fixing it. Operating system updates are often installed automatically, but third-party applications – browsers, PDF readers, archiving or remote access tools – go unnoticed for months. Centralised patch management shows which computers are missing updates and lets you deploy them on schedule.
- Define how quickly critical patches are installed and how quickly all others are.
- Install patches on a test group of computers first, and only then across the whole company.
- Plan to replace applications that the vendor no longer updates.
Vulnerabilities and NIS2
Among the mandatory risk management measures, the NIS2 directive lists security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure. In practice this means a company should be able to show that vulnerabilities are searched for regularly, assessed and removed – not just hope there are none.
The NIS2 directive in Lithuania: what companies must do
First steps: what to do in a month
Vulnerability management can be started without a large project. Here is a realistic plan for the first month:
- In the first week, list all publicly accessible company assets: domains, websites, remote access and mail servers.
- In the second week, enable centralised patch management and see which computers are missing critical updates.
- In the third week, run the first external and internal scan and sort the results by severity.
- In the fourth week, fix critical vulnerabilities, agree on who is responsible and set a regular scanning schedule.
After the first cycle it usually becomes clear where the greatest risk lies and whether it is worth ordering a full penetration test.
Tools we supply
For vulnerability management and security testing we supply solutions from several vendors – from continuous scanning to tests carried out by specialists:
- ImmuniWeb Discovery – external attack surface and threat exposure monitoring.
- ImmuniWeb Neuron and Neuron Mobile – automated security scanning of websites, APIs and mobile apps.
- ImmuniWeb On-Demand and Continuous – penetration tests of websites and APIs, one-off or continuous.
- ImmuniWeb MobileSuite – penetration tests of mobile apps.
- WithSecure Elements Vulnerability Management – continuous scanning of company systems and reports.
- AVG Patch Management – centralised deployment of missing patches.
We provide the price of these solutions on request, as it depends on the number and scope of the assets tested.
Frequently asked questions
How does vulnerability scanning differ from a penetration test?
Scanning is automated and can be carried out often, for example weekly or continuously. A penetration test is carried out by specialists: they not only find vulnerabilities but also check whether they can be exploited and what damage that could cause.
How often should systems be scanned?
Publicly accessible systems should be monitored continuously, and the internal network scanned regularly and after every major change. The exact frequency depends on the importance of the systems and the requirements that apply to the company.
Does a small company need vulnerability management?
Yes, although the scope can be small. For a small company, centralised patch management and periodic checks of the website and publicly accessible services are often enough.
Can scanning disrupt the operation of systems?
Automated scanners are usually designed not to interfere with normal operation, but it is worth scheduling the first scan outside working hours and informing system administrators in advance. The scope and timing of penetration tests are always agreed in advance.
Conclusion
Vulnerability management is not a one-off project – it is a habit of regularly finding and fixing weak spots. Start with an inventory and patch management, then add external attack surface monitoring and periodic tests. If you would like us to help choose tools for your company or customers, write to us.