漏洞管理:The Complete Guide
Vulnerability management is an ongoing process to identify and remediate cyber risks, vulnerabilities and misconfigurations across your entire attack surface, both on-prem and in the cloud.
It includes proactive asset discovery, continuous monitoring, mitigation, remediation and defense controls. If you’re a cybersecurity executive who needs a refresher, an emerging vulnerability management practitioner or are considering purchasing a vulnerability management platform to decrease your exposure, this page is your go-to hub for vulnerability management knowledge.

Learn more about vulnerability management:
Mature your vulnerability management practices
Learn more about a four-step approach to mature your vulnerability management program with a risk-based approach.
了解详情Prevent ransomware with risk-based vulnerability management
Learn more about the role of asset criticality in maturing your vulnerability management practices.
了解详情Vulnerability management plans and processes
Enhance the overall maturity of your cybersecurity program by building a solid vulnerability management foundation with best practices and efficient processes.
了解详情Tenable vulnerability management Connect community
想要与其他漏洞管理专家建立联系吗?Tenable Connect is your go-to place for inspiration, support and idea sharing.
了解详情Exposure remediation and mitigation
See how Tenable Vulnerability Management makes risk-based vulnerability remediation easy.
了解详情Expose and close vulnerabilities across your attack surface to reduce cyber risk
Vulnerability management is a continuous process that should be part of every mature cybersecurity program. Its goal is to reduce cyber risk. Vulnerability management solutions like Tenable Vulnerability Management help you accurately identify, investigate and prioritize vulnerabilities across your attack surface. With Tenable Vulnerability Management you can instantly access accurate, contextual and actionable information about all your assets and vulnerabilities within a single platform.
Vulnerability management technical insights
Elevate your vulnerability remediation maturity: A four-phase path to success
Cyber threats are on the rise. As organizations expand their digital attack surfaces, it increases their risk. However, expanding attack surfaces put security teams in a constant loop of finding and fixing vulnerabilities often without context about which exposures actually put the organization at risk. Without a risk-based approach to vulnerability management, it's nearly impossible to get a strategic view of effective vulnerability remediation. On top of that, many organizations still use slow, manual processes and disparate technologies that make it increasingly difficult to see all vulnerabilities across every asset.
This white paper explores a four-step approach to increase vulnerability remediation maturity. Through each phase, you can learn more about industry recognized best practices to dig out of the mountain of vulnerabilities created by traditional vulnerability management practices.
Learn more about:
- Why organizations struggle to remediate vulnerabilities
- What the vulnerability remediation maturity model is
- How to advance your remediation processes with best practices
- How Tenable can help you take vulnerability management to the next level

如何实施基于风险的漏洞管理
As your attack surface evolves and attack vectors increase, it can be difficult for your security teams to stay ahead of vulnerabilities. That's even further complicated if your organization has assets in the cloud and your team still uses vulnerability management practices designed for on-prem devices.
This ebook outlines how to implement a vulnerability management program by shifting to a risk-based strategy. A risk-based vulnerability management approach helps you more effectively protect your complex attack surface. By using AI and machine-learning-generated models, your teams can get valuable prioritization insight into vulnerabilities that pose an actual threat to your organization and know how and when to remediate them.
在此电子书中,深入了解:
- 如何实施基于风险的漏洞管理计划
- 机器学习如何帮助您的团队降低风险,取得事半功倍之效
- Five steps of the risk-based vulnerability management lifecycle
Overcoming challenges created by disparate vulnerability management tools
Ditch your fragmented toolset for more effective risk assessments and management.
For far too long, security teams have struggled to build a comprehensive vulnerability management program by piecing together disparate tools to handle network vulnerabilities, cloud security issues and web application security. The result is often massive amounts of siloed data that make it nearly impossible to get a complete picture of what’s happening across your expanding attack surface. With traditional vulnerability management solutions, there’s rarely valuable insight into which vulnerabilities pose greatest risk to your organization or recommendations on best practices to remediate them.
The good news is there is a better way to manage and protect your attack surface and you don’t need multiple tools to do it.
Read this white paper to learn more about:
- Why fragmented tools cause you to miss vulnerabilities and the operational impact
- How emerging security threats target multiple environments at the same time
- How a unified vulnerability management program can help you more effectively assess and defend your entire attack surface

The state of vulnerability management
Tenable and HCL Software commissioned a study of more than 400 cybersecurity and IT professionals to get insight into the current state of vulnerability practices. The survey focused on vulnerability identification, prioritization and remediation, with emphasis on current priorities and challenges.
The report found that since both IT and security teams contribute to vulnerability management, the lines can blur between who is responsible for what. This blurred area is one of many security weaknesses bad actors are hoping to take advantage of. They're constantly trying new and more sophisticated tactics, making it increasingly hard for IT and security teams to expose and close critical weaknesses across their vast attack surfaces.
Read this report to take a deeper dive into:
- Key vulnerability management trends
- Respondent thoughts about finding, prioritizing and remediating vulnerabilities
- The relationship between IT and cybersecurity for vulnerability management
Frequently asked vulnerability management questions
漏洞管理是什么?
安全漏洞是什么?
What is a network monitor and how does it help manage vulnerabilities?
何为资产?
攻击面是什么?
How are vulnerability management and exposure management related?
漏洞优先级评级 (VPR) 是什么?
资产重要性评级 (ACR) 是什么?
资产风险暴露评分 (AES) 是什么?
Cyber Exposure 评分是什么,以及其为何如此重要?
What are the key steps in the vulnerability management process?
The key steps in the vulnerability management process include:
- Continuous vulnerability scanning to find vulnerabilities across your entire attack surface
- Using threat intelligence, AI, and machine learning to determine vulnerability severity
- Prioritizing vulnerability remediation based on the threats most likely to impact your organization
- Remediation through patching or other mitigation strategies
- Verification mitigation works
- Ongoing vulnerability monitoring and scanning to find new vulnerabilities
Your vulnerability management processes should also include routine security testing, such as internal and external penetration testing, and documenting policies and procedures. You should also include routine reporting that aligns your cybersecurity risk with business risk so you can share this information routinely with your executives, board members, and other key stakeholders to build program support.
How often should I perform a vulnerability scan?
Which tools are commonly used for vulnerability management?
What is the difference between vulnerability management and penetration testing?
How do vulnerability scanning and patch management work together?
What are common challenges in vulnerability management?
Common challenges in vulnerability management include:
- Complexities of a rapidly expanding attack surface
- Issues identifying all assets across an enterprise and knowing which ones are critical to operations
- High volume of vulnerabilities and new ones constantly pop up
- Hiring shortages of security professionals
- Limited budget and resources dedicated to vulnerability management
- Use of legacy systems
- Too many false positives
- Too much time spent on vulnerabilities attackers aren’t likely to ever exploit
Why is vulnerability management important for compliance?
What is the difference between vulnerability management and risk management?
What role does automation play in vulnerability management?
How can vulnerability management improve an organization's cybersecurity posture?
What are managed security services (MSP) for vulnerability management?
How can I become a vulnerability management specialist?
How can I learn more about the Tenable Vulnerability Management solution?
Manage vulnerabilities with the power of community
Tenable Connect community is a great place where people with common interests in vulnerability management can get together, ask questions and exchange ideas.
下面是一系列常见的沟通示例:
Benchmark for vulnerability management
I would like to ask if there is a global benchmark or industry benchmark available from Tenable for vulnerability management for reference purposes.
See the answerTenable: Leading in worldwide vulnerability management for the fifth year
This research firm’s latest report also provides market insights that security professionals can use to improve their vulnerability management strategy.
了解详情Tenable Vulnerability Management on-prem
Is it possible to install Tenable Vulnerability Management on-prem, on a dedicated VM, instead of using the cloud console?
See the answerVulnerability management solutions to know, expose and close vulnerabilities
Vulnerability management is a way to reduce risk for your organization, no matter how large or small it may be. However, creating a mature vulnerability management program is not a simple task. It requires goal setting, metrics, continuous discovery, monitoring and buy-in from stakeholders across your organization. 不确定该从何入手?You can make your vulnerability management process stronger with these five best practices:
-
发现
Identify and map every asset across all of your computing environments. Continuous discovery and complete visibility into your environment can be challenging without the right vulnerability management tools, but it is vital for discovering and preventing blind spots in your attack surface.
-
评估
Evaluate the exposure of all of your assets, including vulnerabilities, misconfigurations and other security health indicators. 全面的漏洞和错误配置评估远不止于运行扫描功能。还应当运用像 Tenable Vulnerability Management 中那样的一系列数据采集技术,以识别企业中的各种安全问题。
-
确定优先顺序
Understand cyber risk in context of your security and business goals to prioritize remediation based on asset criticality, threat context and vulnerability severity.
-
缓解
Leverage AI and machine learning to spot hidden data patterns that correlate with future threat activity. 这将有利于深入洞察近期遭利用可能性最高的漏洞。From there, prioritize which exposures to mitigate first and then apply the appropriate remediation process.
-
度量
Measure and benchmark your cyber risk to make better-informed business and technology decisions. Tenable Vulnerability Management 中的报告定制功能可提供易于理解的漏洞管理计划有效性和外部基准指标数据,帮助将计划效能与业内类似企业进行对比。
Vulnerability management and protecting your enterprise from cyber threats
For many years, security teams have focused their vulnerability management practices only on their department or team goals. 虽然从传统的角度来说,这一方式取得了一定的成功,但如果企业将安全目标与业务目标相结合,就能够塑造出更强大的企业漏洞管理计划。
By aligning your vulnerability management program to your business goals, you can more easily create and analyze success metrics that enable you to communicate your program success to key stakeholders — like C-Suite executives and board members — in ways they understand. This can help you build a stronger cybersecurity program and get the support of upper-level management so you can access resources to keep your program flexible, scalable and successful. Here are five best practices for enterprise vulnerability management:
-
Establish goals
识别出可衡量且意义重大的特定部分,然后开始攻击面加固、资产清单和补丁审计。
-
Ensure data accuracy
请勿束缚漏洞整体状态的视角。确保及时获取具有可操作性的准确数据。
-
Account for gaps
为了维持可靠的流程并建立信任,需要迅速识别出修补问题的来源,并作为异常进行追踪。
-
Deal with interdependencies and conflicts
了解流程会如何对企业个人和团队产生影响,从而制定成功的漏洞管理计划。
-
Know what to measure
Instead of trends, focus measurement on exceptions to discover weaknesses.
消除盲点。Boost productivity. Prioritize vulnerabilities.
Tenable Vulnerability Management 可操作性强、准确度高的数据有助于识别、研究整个 IT 环境中的漏洞并确定修复的优先顺序,同时缓解错误配置。即刻免费体验。
Vulnerability management blog bytes

Secure your sprawling attack surface with risk-based vulnerability management
From the cloud to AI, new asset types offer organizations increased flexibility and scalability, while decreasing resource barriers. This blog explores how these assets also introduce new cyber risks; challenges identifying, prioritizing and reducing security exposures; and how to go beyond point solutions and reactive patch management to adopt a risk-based approach to more effectively manage vulnerabilities across your sprawling attack surface.

How risk-based vulnerability management boosts your modern IT environment's security posture
While vulnerability assessment and vulnerability management may seem similar, they're not the same. The key to understanding how and why they're different requires a shift from ad-hoc vulnerability assessments to a continuous, risk-focused vulnerability management strategy. Read this blog to learn more about how risk-based vulnerability management can help mature your organization's security posture, especially across complex environments.

Turning data into action: Intelligence-driven vulnerability management
Security teams often feel buried under mountains of vulnerability data. That's because many legacy solutions don't provide prioritization context to help these teams understand where they should focus their attention. This blog explores how Tenable Vulnerability Intelligence and Exposure Response can help your teams make more informed data-driven decisions to increase program effectiveness.

How to perform efficient vulnerability assessments
Preventative cybersecurity measures are important for a mature cybersecurity program, but most security teams don't want to get bogged down gathering information or getting buried in vulnerability data that has little or no context. In this blog, learn more about the benefits of making appropriate risk-based vulnerability assessment decisions and how scan configurations and automation help.

The importance of contextual prioritization
Contextual prioritization of cyber risk is rapidly altering OT/IoT security. In this blog, learn how you can take your vulnerability management processes to the next level by evolving into exposure management, which adds layers of visibility that are vital for effective prioritization.

Is AI vulnerability management on your radar screen?
As more organizations adopt AI systems, security teams have new vulnerabilities and security threats to address. And, unfortunately, many just aren't sure how to approach vulnerabilities in AI systems or if traditional vulnerability practices will work. In this blog, learn more about how AI vulnerabilities are different than conventional ones and how to address them.

An analyst’s guide to cloud-native vulnerability management
Legacy vulnerability management practices weren't designed for the cloud, creating new challenges for security teams that have previously focused on vulnerability management for on-prem assets. This blog explores the unique challenges created by cloud-native workloads, how to overcome these challenges and how to scale cloud-native vulnerability management across your organization.
Vulnerability management on demand
Safeguarding your modern attack surface: Transitioning to risk-based vulnerability management
As your attack surface expands with an increasing volume of assets and diverse asset types, so does your list of vulnerabilities. With so many vulnerabilities and limited resources, many organizations struggle to prioritize remediation for exposures that pose true business risk.
This webinar explores how to evolve your vulnerability management practices to be risk-focused. Learn about how to:
- Find and prioritize vulnerabilities
- Automate remediation processes and generate reports
- More effectively manage vulnerability and asset data
- Automate asset tracking and vulnerability scanning
Vulnerability and risk mitigation strategies when you cannot remediate vulnerabilities on production OT systems
Every organization must address vulnerabilities, but some organizations struggle with finding and fixing OT vulnerabilities. This is often the result of using legacy systems, certain operational constraints and vendor limitations.
This webinar explores how you can adopt more effectives risk mitigation strategies for vulnerabilities within your OT environment you can't immediately address. Learn more about:
- Finding and addressing OT vulnerabilities you can't remediate
- Potential vulnerability risk exposure and potential operational impact
- How to implement controls and mitigation practices to reduce risk
- How to align your vulnerability management program with best practices
Risk and threat management strategies in an evolving digital world
A recent Techstrong Research report has identified common challenges for risk and threat management including web app, APIs, identity and access management and issues addressing risk management in cloud environments.
This webinar explores the crucial role of security teams in helping organizations operate in multi-cloud or hybrid-cloud environments. Learn more about:
- Effective strategies to consolidate and integrate security data into your program
- How cloud-native application protection platforms can secure complex cloud environments
- Steps to mature your cloud-focused vulnerability management program
- How automation and AI can help drive success
Knowing when and why to make the transition from vulnerability risk management to exposure management
Security teams face a growing number of vulnerabilities across an ever-expanding attack surface. They're often tasked with finding more effective and cost-efficient ways to protect these assets.
This webinar explores how organizations can benefit from moving beyond reactive security to a risk-based approach. Learn more about:
- How to get comprehensive visibility into your entire attack surface
- New methods for risk prioritization and exposure context
- How advanced analytics support proactive security
- Criteria and methodology for the “The Forrester Wave: Vulnerability Risk Management, Q3 2023” report
Transitioning to risk-based vulnerability management
With limited resources, vulnerability management can feel daunting. That's because you have a growing number of assets and a complex and diverse attack surface that are becoming harder to track, assess, prioritize and address. Yet, it is possible to maximize the efficiency of your remediation efforts and optimize your vulnerability processes — even with those resource limitations.
This webinar explores how you can more efficiently safeguard your modern attack surface using risk-based vulnerability management. Learn more about how to:
- Stop wasting time and take actionable vulnerability management steps
- Find, prioritize and report on all your assets and their risks
- Automate asset and vulnerability tracking
- Maintain vulnerability management compliance using analysis dashboards
How can risk-based vulnerability management help prevent ransomware attacks?
Ransomware is a common attack vector for threat actors. They know there are common vulnerabilities many organizations overlook, and they're actively trying to find them before you do. That's why finding and fixing your most exploitable vulnerabilities is a critical step in strengthening your cyber defenses.
This webinar explores how ransomware targets vulnerabilities and ways you can find and prioritize the highest-risk vulnerabilities across your entire attack surface. Learn more about:
- Asset criticality and its impact on your vulnerability management processes
- How to enable secure configurations and other safeguards to harden your attack surface
- Steps to mitigate ransomware
Tenable Vulnerability Management for your modern attack surface
Organizations with rapidly-expanding attack surfaces need a vulnerability management solution that can evolve and change with you. Tenable Vulnerability Management provides timely, accurate information about your entire attack surface, including complete insight into all of your assets and vulnerabilities, no matter where they are or how fast they spin up or down.
漏洞评估
Get complete visibility into your attack surface with Nessus sensors within Tenable Vulnerability Management for active and agent scanning and passive network monitoring.
预测优先级分析
Identify which vulnerabilities will have the greatest impact on your organization in the near term with vulnerability data, data science and threat intelligence.
资产追踪
Track highly dynamic assets such as virtual machines, cloud instances, and mobile devices and their vulnerabilities with accuracy.
Passive network monitoring
Continuously monitor network traffic to find and assess hard-to-scan devices and short-lived systems across your attack surface.
Cloud visibility
Get continuous visibility and assessment into your public cloud environments through connectors for Microsoft Azure, Google Cloud Platform and Amazon Web Services (AWS).
Pre-built integrations and flexible APIs
Automate your workflows and share Tenable Vulnerability Management data with other third-party systems with Tenable’s pre-built integrations and well-documented APIs and SDK resources. 请前往 developer.tenable.com 深入了解。
- Tenable Vulnerability Management