Field Notes
Where to start, by maturity level
Nobody adopts a whole vulnerability management program in a month, so here's the order I'd follow. It depends on where the program is today.
The levels are the five from the free self-assessment, from Level 1 (ad hoc) to Level 5 (optimized). If you don't know yours, take it first.
Level 1 or 2: what you have and what's exploited
Get an asset list with an owner and a tier on every system. A high on a crown-jewel system can outrank a critical on a sandbox, but only if "crown jewel" is written down somewhere.
Add a KEV column to the findings you already have. CISA's Known Exploited Vulnerabilities catalog lists the flaws attackers are using, and anything that's exploited and internet-facing goes to the front of the queue. To see which of your CVEs are on the list, paste them into KEV Check. The lookup runs in your browser and nothing you paste is uploaded.
Then adopt a policy, even if it's rough. A written rule you follow beats a perfect one in a draft.
Level 3: a ranking you can defend
You have the pieces. What's usually missing is a ranking you can defend.
Load a scanner export into the prioritization model from the VM Program Kit and compare its order with the order you work in today. Start logging exceptions in a register instead of in email threads.
Level 4 or 5: tell me what's missing
The Kit is probably below where you are. Its prioritization model is still a useful second opinion on your own ranking, so take what helps and skip the rest.
I'd like to hear what a program at that level still lacks, because that's what decides what I build next: support@flintscope.com.
At any level
The Maturity Model, one of the ten files in the free Kit, has the next steps for each area the assessment scores and a 90-day roadmap.
If you advise small businesses that have no security team, I also run a free course written for the owner.