Security · Managed Security Operations · 04
Vulnerability scanning and remediation tracking
Vulnerability scanning and remediation tracking runs the recurring cycle that finds weaknesses, assigns them, follows them to closure and proves it: authenticated scans on a schedule, findings triaged by exposure, tickets with owners and dates, and verification that fixed means fixed. It is needed when scans run but results are not acted on, when critical findings remain open past the window a policy or contract allows, when an auditor asks for remediation evidence, or when the organization has no scanning at all. The service produces scheduled scan results reconciled with the asset inventory, a tracked remediation queue with aging by severity, verification scans that confirm closure, and the monthly metrics that show whether the program is improving.
Scope
What the review covers.
- Scan scheduling, authentication and coverage against the inventory
- Triage by exposure and business context
- Ticketing with owners, dates and SLA tracking
- Verification scans and regression checks
- Exception and risk acceptance handling
- Monthly metrics and reporting
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Scan results and coverage | Reconciled with the asset inventory each cycle |
| Remediation queue | Tracked with owners, dates and aging |
| Verification record | Evidence that findings are closed |
| Monthly metrics | Open findings by severity and age, trend over time |
Prerequisites
What we need from you.
- A scanner, or agreement to specify one
- Credentials for authenticated scanning and an asset inventory
- Access to the ticketing system and the owners who fix things
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
How often do you scan?
On a schedule matched to your obligations and your rate of change. Monthly is a common floor; critical assets are often scanned more often.
Who does the fixing?
Your administrators, your provider or us, by agreement. Tracking is the same whoever fixes.
How does this relate to the program review?
The program review assesses how the cycle works. This service runs the cycle. See Vulnerability management program review.