7.1. Assessment and Audit Strategy Design
💡 First Principle: Vulnerability management is not a project — it is a continuous operational process. New vulnerabilities are discovered daily; the attack surface changes as systems are deployed, modified, and decommissioned. A point-in-time assessment provides a snapshot; only continuous scanning and prioritized patching creates a program that keeps pace with the threat landscape.
Effective vulnerability management is also a prioritization problem. An enterprise may have tens of thousands of vulnerabilities. CVSS scores provide technical severity; EPSS (Exploit Prediction Scoring System) provides exploitation probability; asset criticality provides business context. All three are needed for intelligent remediation sequencing.
Why this matters: Scan methodology, false positive handling, and prioritization logic are directly tested. Questions will ask the difference between authenticated and unauthenticated scans, when to escalate based on CVSS score vs. active exploitation status, and what a false positive versus false negative means in vulnerability management terms.
⚠️ Common Misconception: "A passing vulnerability scan means the system is secure." Scanners find known vulnerabilities they have signatures for. They miss: zero-day vulnerabilities, business logic flaws, configuration issues not in the signature set, and vulnerabilities in components not recognized by the scanner. A clean scan result means "no known vulnerabilities detected" — not "no vulnerabilities exist."
