Mistaking collection for coverage
Duplicate records inflate totals and split findings. Aggressive merging can hide distinct devices. Reconcile stable identities, cloud resources and lifecycle records, retaining enough history to explain rebuilds and retirement. A clean-up exercise should improve fidelity, not simply produce a smaller headline figure.
Check authentication failures, unreachable targets, excluded services and stale heartbeats. Installed agents and completed scans are not proof of usable assessment. Give gaps an owner and date. Systems with the weakest evidence should be visible in reporting rather than quietly omitted from the expected estate.
Confusing severity with urgency
CVSS-only sorting ignores exposure and business consequence. Combine severity with service criticality, access paths, exploitation and controls. Explain deviations from scanner order so operational teams understand why a moderate finding may precede a critical one on an isolated system.
Do not merge predictive and observed exploitation signals. EPSS is an estimate; CISA KEV is known exploitation, not proof of local compromise. Investigate relevant matches promptly without reporting an incident that the evidence does not establish. Keep the assumptions behind prioritisation visible.
Closing before checking
Deployment tools can report success while a reboot is outstanding or another vulnerable installation remains. Verify the affected condition, not just ticket completion. Investigate conflicting evidence rather than closing and reopening repeatedly. Recurrence may point to an outdated build image or unmanaged application deployment.
Confirm licensing and supported scope for Qualys VMDR and Patch Management separately. Do not assume bundled entitlement or automatic coverage of all fixes. Configuration, upgrade and manual work remain necessary. Test jobs and coordinate maintenance rather than treating every vendor update as immediately deployable.
Leaving ownership and exceptions unresolved
Assign findings to teams able to implement remedies and involve owners where disruption is possible. Agree verification and authorisation. A detection is not permission to exploit a system. Sensitive production and operational technology need explicit approval and suitable testing boundaries.
Exceptions must not become permanent hiding places. Record the risk owner, assets, rationale, controls and expiry. Reassess when exposure changes. Show overdue exceptions and unowned findings separately so a smaller open queue cannot conceal unresolved business risk.