Explain like I'm five · Security

What is Vulnerability Management?

Vulnerability management, told as a story about writing every crack in a ledger, fixing the most dangerous first, and going around again every month.

word from the watchtowera bounty notethe hired thief's reportthe carpenter's new boardshow many in all?

Word of cracks comes from everywhere. All scattered.The watchtower, a bounty note, the hired thief, the carpenter. All on different slips of paper, so nobody knows how many cracks the castle has.

200 crackstwo carpentersthe crack by the vault, untouchedfix in the order you see them, and the most dangerous one is left

You can't fix them all at once. Fix at random, and the one by the vault is left.Two hundred cracks, two carpenters. Fix them in the order you see them, and the most dangerous one waits until last.

patrolwrite downline upboard upcheck againCRACK LEDGERvault roomwest windowempty shednot a line but a circle — around again every month

Vulnerability management is walking the same circle every month with the crack ledger.Walk the castle for cracks, write every one in the ledger, line them up by danger, board them up, and walk again to check. Not a line — a circle.

Find them allevery wall, every month
One ledgerall the slips in one place
Most dangerous firstsize × where × in use?
Check againdid the board hold?
thieves use it these dayssmall crack + by the vault + thieves use it→ firstan empty shedbig crack + nothing inside + nobody uses it→ laterit's not just the size — what it's next to, and whether thieves actually use itwith two carpenters, start at number one

Lining them up isn't just about size.How big the crack is, what it's next to, and whether thieves are actually using it these days. Even a small crack goes first if it's by the vault.

123456cracks left in the ledgernew this monththe same round, every monthnew cracks keep coming — that's why it's not a one-time job but an always job

Walk it monthly and the ledger gets shorter. New cracks keep coming, though.New towers go up and new holes get found. That's why it's not a one-time job but an always job.

In one breath

Vulnerability management = find every crack, write it in one ledger, line them up by danger, board them up, and walk the circle again every month.

A continuous cycle: scan all assets for vulnerabilities, prioritize by severity, active exploitation, and asset importance, patch, verify, and repeat.

When grown-ups say it

Vulnerability scanner
The patrol lantern. Walks every wall, finds cracks, and writes them in the ledger for you.
Asset inventory
The list of rooms. You can't patrol a room you don't know exists. Page one of the ledger: how many rooms does the castle have?
CVE
The crack's number tag. A name every castle in the world uses for the same crack: CVE-2024-1234.
CVSS
The crack's size score. From 0 to 10. It tells you the size, not what the crack is next to.
KEV · EPSS
Cracks thieves actually use. A crack in use beats a big crack. → the friend on the watchtower
Prioritization
Lining up. Size × what it's next to × whether thieves use it. Because there are only two carpenters.
Patch
One board. What crosses one line off the ledger. → the boards the carpenter sent
Remediation SLA
Within so many days. Number one within a week, the later ones within three months. Agreed in advance.
Next story
Counting Our Doors from Outside →
Want another term as a picture book? Request →