A vulnerability-management operating model is the agreement that connects discovery to a verified reduction in exposure. It should make the next decision obvious, even when tooling, teams and technologies change.
Start with decisions and accountability
Define who confirms ownership, who accepts risk, who can approve emergency change and who proves closure. Use a RACI only after the real decisions and escalation paths are understood.
Design one flow for every finding
Every finding should move through validation, context, priority, treatment and closure evidence. Automation can enrich and route work, but a person must remain accountable for risk decisions and exceptions.
Measure flow and outcomes
Track coverage, age, inflow, validated closure, exceptions and recurring causes. Vulnerability counts alone reward inventory size rather than risk reduction.
Practical next steps
- Map the current path from detection to verified closure.
- Name the risk owner and remediation owner for each service.
- Automate evidence collection and ticket updates where confidence is high.
- Review blocked priorities weekly and programme outcomes monthly.