Maintain a current asset view
Combine inventory sources for devices, cloud resources, applications and public services. Record ownership, purpose and assessment status. Reconcile duplicate records carefully: one device may have several identifiers, while a reused address may represent different devices over time. Preserve lifecycle context rather than merging solely by address.
Track the last usable evidence for each asset. Monitor agent heartbeat and assessment freshness, network reachability and authentication. Missing evidence should create a coverage action, not count as a clean result. A maintained asset expectation is needed to tell absence of findings from absence of assessment.
Prioritise with context and evidence
CVSS describes technical severity rather than complete business priority. Consider exposure, important services, reachable attack paths and controls. A weakness in a public identity service can require a different response from the same weakness on a restricted test system. Document why the order differs from the default console list.
EPSS estimates exploitation activity probability, not certainty or your specific chance of compromise. CISA KEV records known exploitation. A match matters for prioritisation but does not prove a breach in your estate. Incident investigation and remediation decisions need related but distinct evidence.
Connect detection to accountable work
Route findings to a team able to change the system with evidence, assets, proposed remedy and date. Agree escalation for missing ownership and overdue work. Fit changes into the existing approval process while ensuring urgent exposure can be escalated outside the routine cycle.
Qualys VMDR supports assessment and prioritisation workflows. Qualys Patch Management can support eligible deployment subject to entitlement and configuration. Do not assume it is bundled or that every finding can be patched automatically. Configuration changes, replacement and application-owner testing remain part of the work.
Verify and improve
Separate deployment from remediation success. A patch may need a restart, fail on some devices or leave another component installed. Use an appropriate reassessment of the original condition. The evidence should establish the resolved weakness rather than merely repeat a job's completion message.
Give approved exceptions an owner, controls, expiry and justification. Review recurring failures and coverage gaps. Continuous management depends on this feedback loop, not uncontrolled testing. Fix deployment baselines and ownership problems so repeated findings become less common rather than generate the same ticket every month.