Vulnerability Remediation — Glossary

The process of acting on identified vulnerabilities to reduce or eliminate the associated risk. Remediation is not a single action but a continuous operational discipline that includes patching, segmentation, compensating controls, risk acceptance decisions, and validation. Because new vulnerabilities are discovered continuously, remediation is an ongoing process — not a project with an end date. Effective remediation transforms vulnerability scan output into reduced organizational risk through deliberate, tracked action.

Installing a vendor-released software update that removes or mitigates a vulnerability. Patching is the most common and effective vulnerability remediation technique. Patches come in two forms: scheduled patches released on predictable cycles (monthly, quarterly) that allow for planned testing and deployment; and unscheduled patches released urgently outside the normal cycle in response to zero-day vulnerabilities or active exploitation. Patching is an ongoing process — new patches arrive continuously and must be tested, deployed, and verified across all affected systems.

A security update released outside the vendor's normal patch cycle, typically in response to a zero-day vulnerability or a vulnerability that is actively being exploited in the wild. Unscheduled patches compress the normal testing and deployment timeline because the window between vulnerability disclosure and exploitation is short or nonexistent. Organizations must decide how much testing to perform versus how quickly to deploy — balancing operational risk from an untested patch against security risk from delayed deployment on an actively exploited vulnerability.

An insurance policy that covers a portion of the financial consequences of a cyber incident. Coverage typically includes lost revenue from service outages, data recovery costs, financial losses from phishing attacks, and expenses from privacy-related lawsuits. Cybersecurity insurance is a risk transfer strategy — it moves financial risk to the insurer rather than eliminating the underlying security risk. Common exclusions include intentional acts, unauthorized fund transfers, and certain forms of negligence. The rising frequency of ransomware attacks has driven significant growth in cybersecurity insurance adoption. Insurance complements but does not replace strong technical security controls.

A network architecture strategy that divides systems into isolated zones to contain the impact of a successful attack. If an attacker exploits a vulnerability in one segment, they cannot freely access systems in adjacent segments without crossing a controlled boundary. Segmentation limits lateral movement and reduces the blast radius of a breach. It is especially important when systems cannot be immediately patched: a vulnerable system placed in an isolated segment is harder to exploit from other parts of the network. Two primary forms: physical segmentation (separate hardware) and logical segmentation (VLANs on shared hardware).

A logical segmentation technology that divides a single physical switch into multiple isolated broadcast domains by assigning ports to different virtual networks. Devices on the same VLAN can communicate with each other; devices on different VLANs cannot communicate directly. Inter-VLAN communication requires a Layer 3 device (a router or Layer 3 switch) to route traffic between the VLANs. VLANs provide flexible, cost-effective segmentation on shared infrastructure and are the standard approach for logical network segmentation in enterprise environments.

The most extreme form of network isolation: physically disconnecting a system from all networks so no remote network communication is possible. An air-gapped system has no Ethernet connection, no Wi-Fi, and no other network interface that could be used to reach it from another system. Used when a system cannot be patched, poses unacceptable risk to the rest of the network, and cannot be adequately protected by firewall rules or segmentation alone. Eliminates all remote exploit paths but also eliminates remote administration and connectivity-dependent functionality.

A firewall that provides application-layer visibility and control in addition to traditional IP and port filtering. Unlike basic firewalls, NGFWs can identify the specific application generating traffic — allowing security teams to distinguish legitimate web traffic from anomalous outbound SSH, C2 callbacks, or other unexpected protocols from systems that should not generate them. Placed between network segments, NGFWs enforce inter-segment traffic policies and log anomalous activity, providing both the enforcement and visibility layers that make segmentation operationally effective.

Security measures deployed as a substitute or supplement when the primary remediation action (patching) cannot be performed. Compensating controls reduce the likelihood or impact of exploitation without eliminating the underlying vulnerability. Examples: disabling the vulnerable service, revoking user access to the affected application, restricting external access via firewall rules, modifying router access control lists, or deploying host-based firewalls on the affected server. Compensating controls are temporary bridges intended to reduce risk until full remediation is possible — they are not permanent solutions and should be accompanied by a remediation timeline.

A formally approved decision to leave a vulnerability unremediated because patching is not feasible and the residual risk is judged acceptable. Exceptions are granted through a structured approval process, typically requiring review by a security committee or change control committee. The justification is documented, the risk is explicitly accepted, and the exception is subject to periodic review. Exceptions are not the same as ignoring a vulnerability; they are deliberate, governed risk acceptance decisions. Common grounds: the vulnerability can only be exploited with physical access to a secured facility, or a patch conflict makes deployment impossible until a software upgrade resolves the conflict.

The process of confirming that a remediation action actually removed the vulnerability. Three methods: Rescanning — run a vulnerability scan after patching to confirm the finding no longer appears and to identify missed systems; Auditing — review deployment logs and system records to verify the patch was applied correctly; Verification — manual confirmation, which may include logging into the system to check the patch version or attempting to reproduce the exploit to confirm it is blocked. Validation is essential because patching silently fails more often than expected, particularly at scale.

Continuous, typically automated reporting on the state of vulnerability remediation across the organization. Key metrics tracked: total number of identified vulnerabilities, patched vs. unpatched systems, new threat notifications (newly published CVEs affecting the environment), patch errors where deployment failed, and exceptions and exemptions. Automation is required at enterprise scale — manual tracking across hundreds or thousands of systems is not feasible. Reporting provides real-time visibility into organizational risk, drives accountability for SLA compliance, and gives management the information needed to prioritize resources and escalate delays.