Roadmaps / Security roadmaps / Defensive security and threat management
Vulnerability and Exposure Management
Find the weaknesses across everything an organisation runs, decide which ones matter, and get them fixed before attackers use them.
Estimated time: 15–25 months · At about 10 hours a week.
Beginner Time: 2–3 months
Vulnerabilities, scanning and scoring
Skills
Explain CVE, CWE, CVSS and the NVD. Run authenticated and unauthenticated scans. Validate a finding before reporting it.
Hands-on projects and labs
Install OpenVAS in a lab, scan a deliberately old Linux VM with and without credentials, and compare the results. Build a small asset inventory of your home or lab network with Nmap.
Done when you can…
Explain to a system owner what a finding means, how severe it is and how to fix it. Show why authenticated scanning matters, with your own results.
Beginner
CVE, CWE and the NVD
A CVE identifies one vulnerability, a CWE describes the type of weakness behind it, and the NVD adds scores and affected product data.
Resources
Beginner
Asset inventory
You cannot fix what you do not know you own. Keep an inventory of devices, software, cloud resources and owners, and reconcile it often.
Resources
Beginner
Network and host scanning
Scanners check systems for known vulnerabilities and missing patches. Learn the difference between unauthenticated and authenticated scans, and why the second finds far more.
Resources
Beginner
CVSS scores
CVSS rates how severe a vulnerability is in general. It does not say how likely it is to be exploited or how important the system is.
Resources
Beginner
Patch management
Most fixes are patches. Learn how patches are tested, scheduled and rolled out, and what to do when a system cannot be patched.
Resources
Beginner
Validating findings
Scanners make mistakes, and system owners lose trust when you send them false findings. Check the evidence before you raise a ticket.
Resources
Intermediate Time: 3–4 months
Prioritisation and remediation
Skills
Prioritise with CVSS, EPSS, KEV and asset context together. Use SSVC to make consistent decisions. Run a remediation process with owners, SLAs and exceptions. Handle container, dependency and cloud findings.
Hands-on projects and labs
Take a scan export, enrich every CVE with EPSS and KEV in a script, and rank the results. Scan a few container images with Trivy and decide which findings to fix first.
Done when you can…
Show a ranked fix list that a system owner agrees with. Explain why you put a CVSS 7 above a CVSS 9.
Intermediate
Known exploited vulnerabilities
CISA's KEV catalogue lists vulnerabilities being exploited in the wild. Anything on it that you run should go to the front of the queue.
Resources
Intermediate
EPSS
EPSS estimates the chance a vulnerability will be exploited in the next 30 days. Combine it with CVSS and KEV to separate urgent from merely severe.
Resources
Intermediate
Decision trees with SSVC
SSVC turns facts (is it exploited, is it exposed, how important is the system) into a clear action. It makes prioritisation consistent and explainable.
Resources
Intermediate
Business context
The same vulnerability matters more on an internet-facing payment server than on a test laptop. Add asset criticality and exposure to every decision.
Resources
Intermediate
Remediation process and SLAs
Agree fix times by priority, route findings to the right owners, track exceptions with an end date, and chase what is late.
Resources
Intermediate
Application, container and cloud findings
Vulnerabilities also live in code dependencies, container images and cloud settings. Bring these findings into the same process.
Resources
Trivy
Tool Free Aqua Security
OSV
Docs Free Google and OpenSSF
Advanced Time: 4–6 months
Exposure and attack surface management
Skills
Map an organisation's external attack surface. Respond to a new critical vulnerability within hours. Analyse attack paths across vulnerabilities and identities.
Hands-on projects and labs
Map the external attack surface of a domain you own with subfinder, Amass and certificate logs. Write a Nuclei template for a vulnerability and run it against a lab system. Run BloodHound in a lab Active Directory and find the shortest path to domain admin.
Done when you can…
Find an exposed system nobody knew about, in a scope you are allowed to test. Show which fixes break the most attack paths.
Advanced
External attack surface management
Find everything you expose to the internet, including forgotten subdomains, test systems and cloud services, the way an attacker would.
Resources
Advanced
Internet-wide scan data
Services such as Shodan and Censys scan the whole internet. Use them to see your exposure as outsiders see it.
Resources
Advanced
Fast checks for new vulnerabilities
When a critical vulnerability is announced, you need to know in hours where you are affected. Template scanners make this quick.
Resources
Nuclei
Tool Free ProjectDiscovery
Advanced
Continuous exposure management
Run a regular cycle of scoping, discovery, prioritisation, validation and mobilisation across vulnerabilities, misconfigurations and identities.
Resources
Advanced
Attack path analysis
Chains of small issues often matter more than single big ones. Map paths from exposed systems to crown jewels and break them.
Resources
Advanced
Validating exploitability
Safely check whether a vulnerability can really be reached and used, with permission, before demanding an emergency fix.
Resources
Expert Time: 6–12 months
Programme leadership
Skills
Run a vulnerability and exposure programme with clear service levels. Report risk trends to leadership.
Hands-on projects and labs
Write a vulnerability management policy with SLAs, exceptions and metrics. Build a dashboard of the metrics above from scan data.
Done when you can…
Show a real drop in time to fix for exploited vulnerabilities. Lead the response to a major new vulnerability across an organisation.
Expert
Metrics that matter
Track time to fix by priority, KEV exposure, coverage of the asset inventory and overdue exceptions. Counting open findings alone tells you little.
Resources
Expert
Policy and governance
Set service levels, exception rules and escalation paths with leadership, so fixes do not depend on goodwill.
Resources
Expert
Automating the pipeline
Connect scanners, inventory, ticketing and intelligence so findings reach owners with context automatically and close when fixed.
Resources
OSV
Docs Free Google and OpenSSF
Every organisation has thousands of known vulnerabilities in its software, systems and cloud services, and new ones are published every day. Vulnerability management is the continuous cycle of finding them, judging which are dangerous in this environment, getting the right team to fix them and checking the fix worked.
Exposure management widens the view beyond software flaws to everything an attacker could use: forgotten internet-facing systems, misconfigurations, weak identities and risky attack paths. The core skill is prioritisation, because nobody can fix everything at once.
Why it matters
Exploiting known vulnerabilities is one of the most common ways attackers get in, often within days of disclosure. Organisations need people who can cut through the noise and get the right fixes done fast.
Typical job roles
Entry Vulnerability analyst Runs scans, validates findings and tracks remediation tickets. Mid-level Vulnerability management engineer Runs the scanning platforms, integrations and prioritisation logic. Mid-level Attack surface management analyst Finds and monitors everything the organisation exposes to the internet. Senior Exposure management lead Owns prioritisation, metrics and the relationship with system owners. Lead Head of vulnerability and exposure management Sets policy, service levels and reporting to leadership.