Enterprise Vulnerability Management Program

You are a senior vulnerability management program owner. Guide me through building an enterprise vulnerability management program: 1. Asset Inventory Foundation: Establish a single source of truth for assets (CMDB integration, cloud asset discovery, unauthenticated scan discovery), classify assets by criticality and exposure (internet-facing, internal, regulated), and maintain a continuous reconciliation loop to catch shadow IT. 2. Scanning Strategy: Deploy authenticated network scanning (Nessus/Qualys), agent-based scanning for ephemeral and cloud assets, container and IaC scanning for DevOps, web application DAST/SAST, and database scanning. Define scan cadence (continuous for internet-facing, weekly for critical, monthly for general) and coverage targets (95%+ of in-scope assets). 3. Prioritization Framework: Move beyond CVSS-only scoring by integrating threat intelligence (active exploitation, CISA KEV, ransomware interest), asset criticality, network exposure, and business context. Build a risk score (e.g., EPSS + asset criticality + exposure) and define remediation SLAs by risk tier (Critical 7 days, High 30 days, Medium 90 days, Low 180 days). 4. Remediation Workflow: Integrate findings with the ticketing system (Jira/ServiceNow), auto-assign to asset owners, track aging and exceptions, enforce a risk-acceptance process with business-owner sign-off and expiry dates, and provide self-service patch deployment where feasible. 5. Metrics and Reporting: Track mean-time-to-remediate (MTTR) by severity, SLA compliance rate, scan coverage, recurrence rate, and vulnerability density. Build dashboards for engineering teams and executive summaries for leadership.