Skip to content
VOC.

Vendor-neutral · CVSS v4 · EPSS · KEV · SSVC

Run vulnerability management like an operations center.

A vendor-neutral field guide to building a VOC: know every asset, scan with intent, prioritize with CVSS v4, EPSS and KEV, hold owners to risk-based SLAs, and report progress leadership can act on.

Explore the mapBrowse all guides
areas
8
in-depth guides
12
glossary terms
12
triage / decision● example

Threat signals

  • CVSS-BTE
  • EPSS
  • KEV
  • SSVC

Asset context

  • tier-1 asset
  • internet-facing
  • owner: payments

Decision

P1Act

Priority tier + SLA + owner

Illustrative flow, not live data.

Lifecycle

One loop, owned end to end

A VOC runs the vulnerability lifecycle as a continuous operation with clear hand-offs, not as a quarterly scan-and-spreadsheet exercise.

  1. 01

    Inventory

    Reconcile every asset with an owner, a criticality tier and an exposure.

  2. 02

    Discover

    Authenticated scans, agents, cloud and code scanning — with measured coverage.

  3. 03

    Prioritize

    Combine CVSS, EPSS, KEV and asset context into a small set of tiers.

  4. 04

    Remediate

    Group by fix, route to the owner, track against a risk-based SLA.

  5. 05

    Verify

    Close findings on scan evidence; manage exceptions with an expiry date.

  6. 06

    Report

    Trend time-to-remediate, SLA compliance and exposure for leadership.

VOC area

The VOC map

Eight areas that together make up a working Vulnerability Operations Center. Start with the one that hurts most — each links to focused, practical guides.

  1. 01 · govern

    Operating Model

    Charter, scope, cadence and the roles that own each step.

    2 guides

  2. 02 · inventory

    Asset Inventory

    Know what you own, who owns it and how exposed it is.

    1 guide

  3. 03 · discover

    Scanning Strategy

    Authenticated, agent, cloud, container and code — at the right cadence.

    1 guide

  4. 04 · prioritize

    Prioritization

    CVSS v4, EPSS, KEV and SSVC combined with asset context.

    2 guides

  5. 05 · remediate

    Remediation Workflow

    SLAs, ticketing, routing to owners and verified closure.

    2 guides

  6. 06 · decide

    Exceptions & Risk Acceptance

    Time-boxed exceptions, compensating controls and clear approvers.

    1 guide

  7. 07 · measure

    Metrics & Reporting

    MTTR, coverage, SLA compliance and a board-ready story.

    2 guides

  8. 08 · enable

    Tooling Landscape

    A vendor-neutral map of categories, data flows and selection criteria.

    1 guide

Principles

What separates a VOC from a scanning team

  • 01

    Risk, not severity

    A CVSS base score describes a vulnerability. Priority also needs exploitation evidence and what the asset means to the business.

  • 02

    Fix by owner, not by CVE

    Group findings into the change that removes them — one patch, one upgrade, one config — and route it to the team that can ship it.

  • 03

    Verify, don't trust tickets

    A closed ticket is a claim. A clean rescan or fresh agent data is evidence. Only evidence closes a finding.

  • 04

    Measure flow, not piles

    Raw finding counts go up whenever coverage improves. Time-to-remediate, SLA compliance and exposure windows show whether risk is actually shrinking.

Guides

Latest guides

View all guides
08 · Tooling Landscape
The vulnerability management tooling landscape
A vendor-neutral map of VOC tool categories — inventory, scanners, cloud, containers, SCA, EASM, aggregation, ticketing — and how to choose and connect them.
#tooling#scanners#sbom#rbvm
07 · Metrics & Reporting
Communicating vulnerability risk to leadership
How a VOC reports to executives and the board: audiences, a one-page structure, KRIs vs KPIs, trends over snapshots, and what to leave out.
#reporting#board#kri#metrics
07 · Metrics & Reporting
Vulnerability management metrics that matter
Define and compute the metrics a VOC needs: time to remediate with percentiles, SLA compliance, coverage, backlog age, KEV exposure windows and reopen rate.
#metrics#mttr#sla#coverage
06 · Exceptions & Risk Acceptance
Vulnerability exceptions and risk acceptance
Run a vulnerability exception process that stays honest: exception types, approval by risk level, compensating controls, expiry and an auditable register.
#risk-acceptance#exceptions#governance#compensating-controls
05 · Remediation Workflow
Remediation workflow and ticketing for a VOC
An end-to-end remediation workflow: deduplicate findings, group them by fix, route to owners, integrate with ITSM, and close only on rescan evidence.
#remediation#ticketing#itsm#patch-management
05 · Remediation Workflow
Remediation SLAs: setting deadlines teams can meet
Design risk-based vulnerability remediation SLAs: tiers instead of raw CVSS, when the clock starts and pauses, escalation, and measuring compliance.
#sla#remediation#policy#patch-management

Speak the same language

Short, precise definitions of the scoring systems, catalogs and metrics used throughout the guides.

Open the glossary