--- title: Vulnerability Management Lifecycle: Core Phases | daily.dev description: A structured breakdown of the six-phase vulnerability management lifecycle: asset discovery, vulnerability assessment, risk-based prioritization, remediation,... canonical: https://daily.dev/posts/vulnerability-management-lifecycle-core-phases-f3yx1xrfz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Vulnerability Management Lifecycle: Core Phases | daily.dev og:description: A structured breakdown of the six-phase vulnerability management lifecycle: asset discovery, vulnerability assessment, risk-based prioritization, remediation,... og:url: https://daily.dev/posts/vulnerability-management-lifecycle-core-phases-f3yx1xrfz og:image: https://api.daily.dev/og/posts/f3yx1XRfz.png og:image:alt: Vulnerability Management Lifecycle: Core Phases og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Vulnerability Management Lifecycle: Core Phases **[Orca Security Blog](https://daily.dev/sources/orca-security-blog)** · 14 min read · 0 upvotes · 0 comments ## Summary A structured breakdown of the six-phase vulnerability management lifecycle: asset discovery, vulnerability assessment, risk-based prioritization, remediation, verification and rescanning, and reporting and continuous improvement. Each phase is defined by what it consumes and what artifact it must produce for the next phase. Key points include: scanning and patching cover only two of six phases; NIST does not define this six-phase model (SP 800-40 Rev. 4 covers patch management, not a lifecycle); verification requires a clean rescan, not just a closed ticket; and three metrics — recurrence rate, verification lag, and discovery gap — each diagnose a different phase failure. The post concludes with a pitch for Orca Security's agentless cloud vulnerability management platform. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does NIST define a six-phase vulnerability management lifecycle? No. NIST does not define a six-phase vulnerability management lifecycle. SP 800-40 Rev. 4 covers enterprise patch management planning in five named activities. The CSRC glossary (sourced to NISTIR 8011 Vol. 1) defines vulnerability management as a capability with no phases. NISTIR 8011 Vol. 4 addresses automated assessment of software vulnerability management controls, not a lifecycle. _Teams building or auditing a vulnerability program track NIST guidance updates on daily.dev before they affect compliance requirements._ ### What artifact must each phase of the vulnerability management lifecycle produce? Each phase must hand a specific artifact to the next: asset discovery produces an inventory with a named owner per asset; vulnerability assessment produces a validated finding set with false positives removed; risk-based prioritization produces a ranked queue with an owner and due date per line; remediation produces a change record per item or a recorded acceptance; verification produces evidence the finding is gone or reopens the item; reporting produces trend numbers and one recorded process change. _Security engineers closing gaps in their vulnerability programs find phase-specific guidance like this on daily.dev._ ### How does verification differ from just closing a ticket in vulnerability management? A closed ticket is a claim; a clean rescan is evidence. Verification requires rescanning the asset after the change and matching the result to the change record by asset and finding identifier. A common failure is rebuilding a patched host from the same unpatched image — the finding returns on the next scan as though new, hiding a failed closure. Reopening the original item keeps the recurrence visible. _Developers and security engineers working through verification failures in their scan pipelines follow topics like this on daily.dev._ ## Similar posts on daily.dev - [Real-Time Risk Detection with Automated Vulnerability Assessment Tools](https://daily.dev/posts/real-time-risk-detection-with-automated-vulnerability-assessment-tools-yvwhcfyf9) · Security Boulevard · 1 upvotes · 0 comments - [Vulnerability Prioritization: Modern Methods & Tools](https://daily.dev/posts/vulnerability-prioritization-modern-methods-tools-dk0ne6tng) · Orca Security Blog · 0 upvotes · 0 comments - [Flaw surge fuels need for CISOs to rethink vulnerability management](https://daily.dev/posts/flaw-surge-fuels-need-for-cisos-to-rethink-vulnerability-management-otbfbwnn6) · CSO Online · 0 upvotes · 0 comments - [Vulnerability Backlogs Are an Ownership Problem](https://daily.dev/posts/vulnerability-backlogs-are-an-ownership-problem-mpe2uqebk) · Dark Reading · 0 upvotes · 0 comments - [Attack Surface Management 2026: Why Point-in-Time Scans Fail](https://daily.dev/posts/attack-surface-management-2026-why-point-in-time-scans-fail-mczcx94i0) · Cyble · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/vulnerability-management-lifecycle-core-phases-f3yx1xrfz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Vulnerability Management Lifecycle: Core Phases","url":"https://daily.dev/posts/vulnerability-management-lifecycle-core-phases-f3yx1xrfz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/vulnerability-management-lifecycle-core-phases-f3yx1xrfz"},"datePublished":"2026-08-07T12:53:35.688Z","dateModified":"2026-08-07T12:54:10.737Z","description":"A structured breakdown of the six-phase vulnerability management lifecycle: asset discovery, vulnerability assessment, risk-based prioritization, remediation,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d43dae9c5be97cf67bc2cc8a1cb7302d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d43dae9c5be97cf67bc2cc8a1cb7302d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Orca Security Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Orca Security Blog","logo":"https://media.daily.dev/image/upload/s--kkQFNboJ--/f_auto,q_auto/v1780213281/logos/orca-security-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/orca-security-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/vulnerability-management-lifecycle-core-phases-f3yx1xrfz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Orca Security Blog","item":"https://daily.dev/sources/orca-security-blog"},{"@type":"ListItem","position":3,"name":"Vulnerability Management Lifecycle: Core Phases"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/vulnerability-management-lifecycle-core-phases-f3yx1xrfz#faq","mainEntity":[{"@type":"Question","name":"Does NIST define a six-phase vulnerability management lifecycle?","acceptedAnswer":{"@type":"Answer","text":"No. NIST does not define a six-phase vulnerability management lifecycle. SP 800-40 Rev. 4 covers enterprise patch management planning in five named activities. The CSRC glossary (sourced to NISTIR 8011 Vol. 1) defines vulnerability management as a capability with no phases. NISTIR 8011 Vol. 4 addresses automated assessment of software vulnerability management controls, not a lifecycle. Teams building or auditing a vulnerability program track NIST guidance updates on daily.dev before they affect compliance requirements."}},{"@type":"Question","name":"What artifact must each phase of the vulnerability management lifecycle produce?","acceptedAnswer":{"@type":"Answer","text":"Each phase must hand a specific artifact to the next: asset discovery produces an inventory with a named owner per asset; vulnerability assessment produces a validated finding set with false positives removed; risk-based prioritization produces a ranked queue with an owner and due date per line; remediation produces a change record per item or a recorded acceptance; verification produces evidence the finding is gone or reopens the item; reporting produces trend numbers and one recorded process change. Security engineers closing gaps in their vulnerability programs find phase-specific guidance like this on daily.dev."}},{"@type":"Question","name":"How does verification differ from just closing a ticket in vulnerability management?","acceptedAnswer":{"@type":"Answer","text":"A closed ticket is a claim; a clean rescan is evidence. Verification requires rescanning the asset after the change and matching the result to the change record by asset and finding identifier. A common failure is rebuilding a patched host from the same unpatched image — the finding returns on the next scan as though new, hiding a failed closure. Reopening the original item keeps the recurrence visible. Developers and security engineers working through verification failures in their scan pipelines follow topics like this on daily.dev."}}]} ```