Intro
I built a vulnerability management program for a simulated organization that started with no policy, no scanning, and no remediation process. I wrote the policy (using a sample template), negotiated remediation deadlines with the server team, ran credentialed Tenable scans against a Windows Server in Azure, and fixed findings one change at a time, verifying each fix with a rescan. Findings went from 27 to 5, an 81% reduction.
Tools and Concepts
Tenable Vulnerability Management, Nessus credentialed scanning, Azure VMs, PowerShell remediation, CVSS and VPR prioritization, CIS Benchmark compliance auditing, change management with rollback plans, and risk exception handling.
Project Reflection
The biggest lesson was that finding count and risk are not the same thing. Removing one outdated Wireshark install cleared 17 of the 27 findings, while Windows updates closed only 2 but still went first, because a server that stops receiving patches keeps falling further behind. The two remaining criticals were in Microsoft-owned libcurl files with no patched version available yet, so instead of ignoring them I documented them as formal risk exceptions with a review date. They scored 9.1 on CVSS but only 4.3 on Tenable’s VPR, which showed me why prioritizing by real-world exploitation matters more than the severity score that Tenable showed.