0 / 24

Model 52 of 74 · Cybersecurity

Vulnerability Management Maturity Assessment

Assess how well your organisation finds, prioritises, and fixes security weaknesses before attackers exploit them.

Pillars & areas

Discover

Know your exposure

  1. 01Asset Discovery & Coverage
  2. 02Vulnerability Identification

Prioritise

Focus on what matters

  1. 03Risk-Based Prioritisation
  2. 04Remediation & Patching

Remediate

Close the gaps

  1. 05Exceptions & Compensating Controls
  2. 06Metrics, Governance & Disclosure

Levels

  1. 1Scan-and-ForgetFindings pile up
  2. 2Risk-PrioritisedOwned & prioritised
  3. 3Exposure-ManagedExposure falling steadily

01 Asset Discovery & Coverage

Does the organisation know what it has, so that nothing is left unassessed?

0/4 answered

AD-1How complete is your inventory of technology assets?

Think about servers, endpoints, network devices, cloud resources, applications and software components.

AD-2How does your organisation find unknown or unmanaged assets?

Consider shadow IT, forgotten servers, test environments and devices connected without approval.

AD-3How well do you understand your internet-facing attack surface?

Think about websites, domains, exposed services, cloud storage and remote access systems visible from the internet.

AD-4How well do you know which assets matter most?

Consider whether critical systems, sensitive data stores and crown-jewel applications are identified.

02 Vulnerability Identification

Are vulnerabilities found across all types of asset, frequently enough to matter?

0/4 answered

VI-1How often and how widely are systems scanned for vulnerabilities?

Think about coverage across servers, endpoints, network devices and cloud, and how often scans run.

VI-2How are applications and software components assessed?

Consider custom applications, open-source libraries, containers and commercial software.

VI-3How are configuration weaknesses identified?

Think about insecure settings, default credentials, unnecessary services and cloud misconfigurations.

VI-4How does your organisation keep informed about newly disclosed vulnerabilities?

Consider vendor advisories, government alerts and threat intelligence about vulnerabilities being actively exploited.

03 Risk-Based Prioritisation

Are the vulnerabilities that pose the greatest real risk fixed first?

0/4 answered

RP-1How are vulnerabilities prioritised?

Think about whether priority is based only on a severity score, or also on asset importance, exposure and whether attackers are exploiting the weakness.

RP-2How does threat information influence prioritisation?

Consider whether known exploitation in the wild moves a vulnerability to the top of the list.

RP-3How is the vulnerability backlog managed?

Think about the total number of open findings and whether it is growing or shrinking.

RP-4How are priorities communicated to the teams who fix vulnerabilities?

Consider whether remediation teams receive clear, actionable work or long scanner reports.

04 Remediation & Patching

Are vulnerabilities fixed quickly and reliably, without disrupting the business?

0/4 answered

RM-1What remediation timescales are defined and met?

Think about target times to fix vulnerabilities of different priorities, and how often they are achieved.

RM-2How is routine patching managed?

Consider operating systems, applications, firmware and network devices.

RM-3How does your organisation handle emergency patching?

Think about how quickly you can respond when a critical, actively exploited vulnerability is announced.

RM-4How are fixes verified?

Consider whether anyone confirms that vulnerabilities are actually gone after remediation.

05 Exceptions & Compensating Controls

Are vulnerabilities that cannot be fixed managed through approved, time-limited exceptions and alternative controls?

0/4 answered

EX-1How are exceptions to remediation managed?

Think about what happens when a vulnerability cannot be fixed within its target time.

EX-2How are compensating controls used when a fix is not possible?

Consider isolation, additional monitoring, configuration changes or disabling vulnerable features.

EX-3How are legacy and unsupported systems handled?

Think about systems running software that no longer receives security updates.

EX-4How visible is accepted vulnerability risk to leadership?

Consider whether leaders know how much risk has been accepted and where.

06 Metrics, Governance & Disclosure

Is vulnerability management governed, measured and open to reports from outside?

0/4 answered

MG-1How is vulnerability management governed?

Think about policy, roles and responsibilities across security and IT teams.

MG-2What metrics are used to manage vulnerability management?

Consider whether you track counts of findings, or measures of exposure and speed of remediation.

MG-3How can external researchers report vulnerabilities to your organisation?

Think about whether someone who finds a weakness in your website or product knows how to tell you safely.

MG-4How does the vulnerability management programme improve over time?

Consider whether the programme is reviewed and adjusted based on results and incidents.

Self-assessment report

Vulnerability Management

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Vulnerability Management maturity model

Most successful cyber attacks exploit weaknesses that were already known: unpatched software, misconfigured systems, exposed services and default credentials. Organisations rarely lack information about their vulnerabilities — scanners produce thousands of findings — but they struggle to know which ones matter, who should fix them, and whether they actually get fixed. The result is a growing backlog, frustrated teams, and critical exposures that stay open for months.

This model assesses vulnerability management as a continuous cycle of knowing what you have, finding weaknesses, deciding what matters most, fixing it, managing what cannot be fixed, and measuring progress. It focuses on reducing real exposure rather than counting scans or closing tickets. It covers infrastructure, endpoints, cloud services, applications and third-party software, and is designed for organisations of any size.

The Vulnerability Management maturity model contains 24 questions across 6 areas: asset discovery and coverage, vulnerability identification, risk-based prioritisation, remediation and patching, exceptions and compensating controls, and metrics, governance and disclosure. Each question describes three levels of maturity through observable practices. It goes deeper than the vulnerability aspects of the Enterprise Security and DevSecOps models.

Who this assessment is for

  • CISOs and security managers
  • Vulnerability management and security operations teams
  • IT operations, infrastructure and endpoint teams responsible for patching
  • Application and cloud engineering teams
  • Risk and audit professionals reviewing security controls

The three maturity levels

  • Level 1 — Scan-and-Forget: Vulnerability scans run occasionally and cover only part of the environment. Reports with thousands of findings are sent to IT teams without clear priorities or ownership, so little gets fixed. Patching is irregular, nobody knows how long critical vulnerabilities stay open, and exceptions are informal. The organisation often learns about serious exposures from news headlines or attackers.
  • Level 2 — Risk-Prioritised: An asset inventory supports regular scanning across most of the environment. Findings are prioritised using severity together with asset importance and exploitability, assigned to owners, and remediated within defined timescales. Patching follows a regular cycle, exceptions are documented and approved, and key metrics such as time to remediate are reported to leadership.
  • Level 3 — Exposure-Managed: The organisation knows its full attack surface, including cloud, external-facing and third-party components, and has an up-to-date view of its exposure. Prioritisation reflects real-world threat activity and business impact, the most dangerous weaknesses are fixed within days, and remediation is built into normal operations. Exceptions are rare and time-limited, and metrics show exposure falling over time.

The 6 areas assessed

1. Asset Discovery & Coverage

The foundation of vulnerability management. This area covers the asset inventory, discovery of unknown or unmanaged assets, the external attack surface, and the identification of business-critical assets.

2. Vulnerability Identification

How weaknesses are found. This area covers scanning coverage and frequency, application and software component testing, configuration weaknesses, and the use of threat and vulnerability intelligence.

3. Risk-Based Prioritisation

How the organisation decides what to fix first. This area covers the factors used in prioritisation, the use of exploit and threat information, handling of large backlogs, and how priorities are communicated to remediation teams.

4. Remediation & Patching

How weaknesses are fixed. This area covers remediation timescales, patch management processes, emergency patching, and verification that fixes have worked.

5. Exceptions & Compensating Controls

How the organisation manages weaknesses it cannot fix immediately. This area covers the exception process, compensating controls, legacy and unsupported systems, and the visibility of accepted risk.

6. Metrics, Governance & Disclosure

How the programme is governed and measured. This area covers vulnerability management policy and ownership, performance metrics, external vulnerability disclosure, and continuous improvement of the programme.

How this model relates to other frameworks

This is an original, simplified maturity model and is not derived from or intended to replace any of the following. However, organisations that use this assessment may also find value in these established frameworks:

  • CIS Critical Security Controls (Control 7: Continuous Vulnerability Management) — a prioritised set of security safeguards, including vulnerability management
  • NIST SP 800-40 (Enterprise patch management) — guidance on planning enterprise patch management
  • CVSS, EPSS and the CISA Known Exploited Vulnerabilities catalogue — widely used sources for scoring and prioritising vulnerabilities
  • ISO/IEC 29147 and 30111 — standards for vulnerability disclosure and vulnerability handling processes
  • UK NCSC vulnerability management guidance — practical guidance from the UK National Cyber Security Centre

Frequently asked questions

What is the Vulnerability Management maturity model?

Assess how well your organisation finds, prioritises, and fixes security weaknesses before attackers exploit them. It is an original, simplified model with three maturity levels (Scan-and-Forget, Risk-Prioritised and Exposure-Managed), assessed through 24 questions across 6 areas: Asset Discovery & Coverage, Vulnerability Identification, Risk-Based Prioritisation, Remediation & Patching, Exceptions & Compensating Controls and Metrics, Governance & Disclosure.

How long does the Vulnerability Management assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Scan-and-Forget), 2 (Risk-Prioritised) or 3 (Exposure-Managed). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.