CVSS alone is insufficient. Use multi-factor prioritization:

1. CVSS v4.0 Base Score — theoretical severity
2. EPSS Score — probability of exploitation in next 30 days
3. CISA KEV Catalog — confirmed actively exploited
4. SSVC Decision Tree — Stakeholder-Specific Vulnerability Categorization
   ├── Exploitation: None / PoC / Active
   ├── Exposure: Small / Controlled / Open
   ├── Utility: Laborious / Efficient / Automatable
   ├── Impact: Low / Medium / High
   └── Decision: Defer / Scheduled / Out-of-cycle / Immediate

Priority matrix:
├── CISA KEV = Immediate (regardless of CVSS)
├── EPSS > 0.5 + CVSS ≥ 7.0 = Immediate
├── EPSS > 0.1 + Internet-facing = Out-of-cycle
├── CVSS ≥ 9.0 + No compensating controls = Out-of-cycle
└── Everything else = Scheduled based on CVSS

# Query EPSS API
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-1234" | jq '.data[0]'

# Query CISA KEV
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | \
  jq '.vulnerabilities[] | select(.cveID=="CVE-2024-1234")'

# Network scanning (OpenVAS/Greenbone)
gvm-cli socket --socketpath /run/gvmd.sock --xml \
  "<create_target><name>Internal Scan</name><hosts>10.0.0.0/24</hosts></create_target>"

# Authenticated scanning (more accurate)
# Windows: Domain credential or local admin
# Linux: SSH key-based authentication
# Web apps: Authenticated scanning with session tokens

# Scan scheduling:
# Internal servers: Weekly authenticated scan
# Internet-facing: Daily unauthenticated + weekly authenticated
# Development: On-commit (SAST/SCA), weekly infrastructure
# Cloud: Continuous (CSPM) + weekly agent-based

# Coverage metrics:
# Asset coverage: % of known assets with recent scan (<7 days)
# Scan success rate: % of scans completing without errors
# Authentication rate: % of scans with valid credentials

Vulnerability lifecycle:
1. Discovery — Scanner identifies vulnerability
2. Validation — Confirm (not false positive), determine exploitability
3. Prioritization — CVSS + EPSS + KEV + business context
4. Assignment — Route to system/app owner
5. Remediation — Patch, upgrade, config change, or compensating control
6. Verification — Rescan to confirm fix
7. Closure — Document resolution, update tracking

Exception management:
├── Risk acceptance: Business owner signs off, time-limited (90 days max)
├── Compensating control: WAF rule, network segmentation, monitoring
├── False positive: Document evidence, suppress in scanner
└── Deferred: Scheduled for next maintenance window, within SLA

SLA enforcement:
├── Auto-escalation: Notify manager at 75% SLA
├── Auto-escalation: Notify CISO at 100% SLA
├── Dashboard: Real-time SLA compliance visibility
└── Exception: Requires VP+ approval, max 90-day extension

Operational metrics:
├── Mean Time to Remediate (MTTR) by severity
├── SLA compliance rate (% remediated within SLA)
├── Open vulnerability count by severity (trend)
├── Vulnerability density (vulns per asset)
├── Scan coverage (% assets scanned in last 7 days)
├── Recurrence rate (vulns that reappear after remediation)
└── Exception count and aging

Executive metrics:
├── Risk reduction trend (critical+high over time)
├── SLA compliance by business unit
├── Top 10 riskiest assets
├── Patch compliance rate
└── Comparison to industry benchmarks