Where this offering fits
Vulnerability Response Management addresses what happens after scanners produce findings. The central requirement is accountable prioritisation, assignment and closure across systems and teams. A second dashboard has limited value if the remediation owner still cannot identify the affected asset or validate a fix.
Architecture and rollout decisions
Confirm supported scanner, asset and ticket integrations. Reconcile duplicate findings and asset identity in a pilot. Define priority with business context and assign an owner. Test an exception, a completed fix and a failed retest. Reporting should distinguish closed evidence from a ticket merely marked resolved.
An evaluation scenario for this offering
Create a small test set in which two scanner records refer to one fictional asset, another finding lacks an owner and a third has an approved temporary exception. Follow these through reconciliation, assignment and reporting under the selected integration. Mark one remediation ticket complete while its agreed retest still fails, and confirm that technical closure remains distinguishable from administrative resolution. Retain asset identity, priority rationale, exception approval and retest evidence. This pilot should show how the workflow handles uncertainty and incomplete treatment, rather than improving reported closure rates by hiding duplicate or unresolved findings.
Evidence to request for this scope
- Map incoming findings to assets and owners.
- Validate prioritisation and exception approval.
- Require retest evidence for the agreed closure condition.