Manage technology vulnerability exposure at the portfolio level

Overview

Security vulnerability management at the individual system or application level is a well-established security practice in most organizations. Technology vulnerability management at the portfolio level — aggregating vulnerability exposure across the full Technologies Inventory family, prioritizing remediation by portfolio-wide impact rather than system-by-system priority, and tracking remediation progress as a portfolio-level security health metric — is a less common but substantially more powerful governance discipline. The difference is the ability to see the full scope of a vulnerability’s impact across the portfolio simultaneously, to allocate remediation resources according to portfolio-wide severity rather than each team’s local assessment, and to measure the organization’s overall vulnerability posture as a portfolio metric that leadership can act on.

Best Practice

Manage technology vulnerability exposure as a portfolio-level governance discipline by aggregating vulnerability data from all Technologies Inventory types into a portfolio vulnerability view that reflects the full scope of known, unmitigated vulnerabilities across all technologies in use. For each known vulnerability, the portfolio view should reflect: the affected technology and version; the severity of the vulnerability using the Common Vulnerability Scoring System; the adoption concentration of the affected technology, showing how many applications and business capabilities are exposed; the remediation status and the timeline to remediation; and the compensating controls in place during the remediation period. Use the portfolio vulnerability view to produce governance reports that show the organization’s aggregate vulnerability exposure by severity and by adoption impact, enabling prioritization of remediation resources toward the vulnerabilities with the greatest portfolio-wide impact.

Benefit(s)

Portfolio-level vulnerability management produces a substantially more efficient allocation of remediation resources than system-by-system vulnerability management. Remediation resources are directed to the vulnerabilities whose elimination reduces the greatest portfolio-wide exposure rather than to the vulnerabilities that are easiest to remediate or most recently discovered. Leadership receives a current, comprehensible picture of the organization’s aggregate vulnerability posture that enables informed security investment decisions. And the portfolio vulnerability metric — the aggregate severity-weighted vulnerability count across the full Technologies Inventory — provides a continuous measure of improvement or deterioration in the organization’s security posture that point-in-time assessments cannot provide.