You cannot protect what you cannot see, so a trustworthy asset inventory is the foundation of the whole program. The goal of this section is to confirm that the organisation knows what exists, who owns it, and how critical it is. Gaps here cascade into every downstream metric, because unknown assets are simply unscanned and unpatched.

Pay particular attention to ephemeral and shadow assets such as cloud instances, containers and unmanaged devices, which routinely fall outside traditional inventories.

Scanning is how the program actually sees vulnerabilities, so both its breadth and its frequency matter. The goal here is to confirm that scans reach every asset class with appropriate depth and run often enough to keep pace with change. Authenticated scans in particular reveal far more than unauthenticated ones and should be the default for managed systems.

Match cadence to asset risk. Internet-facing and critical systems warrant more frequent assessment than low-risk internal devices.

With more vulnerabilities than any team can fix at once, prioritisation is where a mature program earns its keep. The objective is to focus remediation on the vulnerabilities most likely to be exploited against the assets that matter most. Raw CVSS severity alone is a weak predictor of real risk and should never be the sole driver.

Combine threat signals with asset context. A medium-severity flaw on an internet-facing crown-jewel system can far outrank a critical one on an isolated test box.

Finding vulnerabilities means nothing without a reliable path to fixing them. This section confirms that there is an owned, tracked workflow moving findings from discovery to verified closure within agreed timeframes. Clear SLAs tied to risk turn prioritisation into accountable action.

Verify fixes rather than trusting them. A vulnerability is only closed once a rescan or test confirms the remediation actually worked.

Some vulnerabilities cannot be patched promptly because of operational, compatibility or business constraints. The goal of this section is to ensure those cases are handled through a disciplined, time-bound exception process rather than quietly ignored. Every exception should reduce, not hide, the underlying risk.

Require compensating controls and an expiry date for each exception so that risk acceptance is explicit, owned and revisited.

Metrics make the program visible, measurable and improvable. The objective here is to confirm that the team tracks meaningful indicators of risk and performance and reports them to the right audiences. Good metrics drive behaviour, so choose ones that reward genuine risk reduction rather than mere activity.

Tailor reporting to its audience. Executives need risk and trend, while operational teams need actionable, asset-level detail.

Governance is what keeps the program funded, mandated and continuously improving rather than drifting. The goal of this section is to confirm there is clear ownership, documented policy and management support behind the operational work. Without governance, even a technically strong program decays over time.

Tie the program to recognised frameworks and review it on a schedule so it evolves with the organisation and the threat landscape.