Level Up Your Vulnerability Management Program

Andy Jordan opens by observing that many organizations stop at deploying a vulnerability scanner. He names three recurring causes: scanner results that conflict with patch reports, little guidance for prioritizing a growing backlog, and manual processes with no clear path to automation. He frames vulnerability management as a lifecycle shared by security and IT, contrasting the security view with the IT patch cycle of staging, deployment and validation.

The middle of the talk covers practical setup in Nessus Pro, including default scan types, the value of authenticated scanning and tuning of concurrency settings. A lab test of different concurrency levels showed modest network and CPU impact and little memory change, so scanner sizing can rest on measurement rather than assumption. For missing asset inventories, he suggests building a working list from existing scan, endpoint and directory data, then adding application, exposure and logging context. He compares binary, NIST SP 800-30 and FAIR risk models, and recommends tracking findings by vulnerability and platform along with closure times. He cautions against pushing raw scan output straight into ticketing and proposes a few orchestration triggers, such as critical findings on mission-critical systems or exploitable externally facing hosts.

He closes with a scenario showing how a report enriched with asset context and root-cause fixes changes the conversation with IT. In the questions he discusses agent-based versus network scanning, preferring agents with network scanners as a backup, and the difficulty of assigning ownership for cloud assets.