Insights · Field note · Security assurance and compliance
Why most vulnerability programs produce findings and not fixes
The scanner runs every week and the count never falls. The program is measuring discovery when it should be measuring closure.
Most vulnerability programs are built around a scanner and measured by what it finds. The count grows, the report circulates, and the same critical findings appear month after month because nobody owns them, nothing is prioritized by real exposure, timelines are aspirational and closure is never verified. A program that produces fixes is measured by remediation time by severity, has an owner for every asset, prioritizes by exploitability and exposure rather than scanner score, documents exceptions as formal risk acceptances, and verifies closure by rescanning. The scanner is the input; the process is the control.
In detail
What the evidence shows.
The failure pattern
Scan coverage is incomplete because the asset inventory is. Findings go to a shared mailbox. Severity is the scanner’s, not the business’s, so an unreachable internal host outranks an exposed login page. No timelines are enforced. Exceptions are informal. Nothing is rescanned after a fix is claimed. The report shows thousands of findings and the organization believes it has a program.
What a working program measures
Coverage: scanned assets against the inventory. Remediation time by severity against policy and contract. Open findings past their timeline, by owner. Exceptions with acceptance records and expiry. Verification: findings confirmed closed by rescan. These are the numbers auditors, customers and insurers ask for, and they are the ones that drive fixes.
Prioritization that works
Exploitability, exposure to the internet, the data behind the system and the existence of known exploitation weigh more than a base severity score. A short list of findings that matter, owned and dated, closes; a long list sorted by score does not. In our reviews (first-hand) the single change with the largest effect is giving each asset an owner who is measured on closure.
Where to start
Reconcile the inventory to scan coverage. Set timelines by severity and enforce them. Route findings to owners through the ticketing system. Record exceptions as risk acceptances. Rescan to verify. See vulnerability management program review and penetration test versus vulnerability management review.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days