Vulnerability Management Program Kit
A complete, practitioner-built program — policy, prioritization model, SLAs, workflows, metrics, and exec reporting. Ranked by real exploitability, not raw CVSS scores.
| Finding | CVSS | EPSS | KEV | Asset · Exposure | Priority |
|---|
Most teams build VM from scratch — stitching a policy together from blog posts, sorting findings by severity, and chasing "criticals" nobody is exploiting while the vulnerability on CISA's Known-Exploited list waits in the backlog.
The kit fixes the ranking first. A two-stage model puts exploitation status and business exposure ahead of raw score, so the work queue reflects real risk — and you can defend every decision to an auditor or a board.
What's inside
VM policy, operating standard, scope and asset-coverage definition, roles & RACI.
Risk-based auto-scoring worksheet (KEV · EPSS · criticality · exposure) plus the methodology to defend it.
The engine · why teams buyPriority-to-SLA mapping, tunable to your risk appetite.
Vulnerability lifecycle, triage runbook, exception & risk-acceptance process with register.
Tool-agnostic playbooks with notes for Tenable, Qualys, Rapid7, Wiz, and Snyk.
KPI pack — coverage, MTTR, SLA adherence — plus executive and board reporting templates.
Five-level maturity model, self-assessment, and a 90-day program roadmap.
Mapped to NIST CSF, PCI DSS (req 6 & 11), ISO 27001, and SOC 2.
Implementation guide and stakeholder comms — kickoff, onboarding, escalation.
The differentiator
A CVSS 7.5 that's on the Known-Exploited list, internet-facing, on a crown-jewel asset is a fire. A CVSS 9.1 with near-zero exploit probability, sitting internal and segmented on a non-prod box, is a scheduled ticket.
The model encodes exactly that: a threat gate that overrides on KEV and active exploitation, then a composite score across severity, exploit likelihood, asset criticality, and exposure. Flip the demo above — that reshuffle is the daily reality CVSS-only programs get wrong.
Free — no email required to start
The fastest way to trust a method is to use it. These four are free and stand on their own — the emergency-lane rule, a working prioritization check, and plain-English basics. Share them with your team; that's the point.
Eight questions that place your program on a five-level scale and tell you the first things to fix. No sales call at the end.
Drop in a finding, answer three yes/no questions, get FIX NOW / FIX SOON / STANDARD QUEUE. The thesis, demonstrable in thirty seconds.
The single triage rule that catches your most dangerous findings — fully operationalized in four steps, adoptable this week. Free feed, one lookup.
Six security steps a business with no security team can finish this week — all free, plain English. Stops the scams that actually hit small businesses.
Outgrew these? The VM Program Kit picks up where they leave off. But start here — it's genuinely enough for a lot of teams.
Built by an operator
I'm Nick Strupp. At Accenture I built and scaled an application-security and vulnerability-management program from 12 people to 60, covering more than 5,000 applications — running the same risk-based prioritization this kit ships with. The kit is that program, written down, minus the years of trial and error.
The kit
Questions
No. The prioritization model and SLA logic are the operating decisions, not boilerplate — the documents are the easy part. The model is the reason a security leader buys this instead of writing a policy from a blog post.
Yes. It's tool-agnostic, with onboarding notes for the major scanners — Tenable, Qualys, Rapid7, Wiz, and Snyk.
Yes. It maps to NIST CSF, PCI DSS, ISO 27001, and SOC 2, and the methodology document explains every scoring decision so you can justify the program to auditors and leadership.
Editable Word and Excel files, delivered the moment you buy. You adapt every document to your own organization and tooling, and updates are included as standards and the threat landscape shift.
Free
Take the VM Maturity Self-Assessment — a quick scorecard across coverage, prioritization, remediation, and metrics. We'll send your results.
Something went wrong. Please try again, or email us directly.