5.4 Million Vulnerabilities and Counting...

The speaker, who leads a four-person vulnerability management team at a large manufacturer with roughly 70,000 to 80,000 devices, explains how the program began in 2017 with known problems: growing regulatory and contractual pressure, weak scanning, patching that lost out to operational work, and unclear ownership. Vulnerability counts climbed from about 300,000 to over a million as workstations were added to scanning, and an overdue backlog grew each month.

The team restructured in 2019, drove the overdue backlog down sharply, and built a shared knowledge base so that many administrators stopped duplicating research. Much of patching moved to automated tooling and remediation was centralized. From this experience the speaker proposed a six-domain framework: asset management, administrative controls, detection, prioritization and mitigation, remediation, and metrics reporting. Asset management comes first, combining static and dynamic inventories and recording both device owners and software owners. Detection should run at least as often as the patch SLA requires, and patch installation has to be verified rather than assumed.

The talk also covered treating out-of-band emergency patches as incident response, tailoring metrics to senior management, middle management and the people doing the patching, and formally accepting residual risk. The speaker reported remediation rates around 98 percent over several years. The takeaway for practitioners is to establish inventory, ownership and verification before chasing raw vulnerability counts, and to size the program to the organization's actual risk exposure.