Vulnerability management,
written down
Notes on scanning your attack surface, resolving vulnerabilities, and proving compliance from fellow practitioners.
11 articles
ENISA Threat Landscape 2026: key threats and trends for IT and security teams
ENISA Threat Landscape 2026 ranks financially motivated attacks as the greatest short-term threat to EU organisations. Findings and checks for IT teams.
How to answer a customer security questionnaire with vulnerability evidence
Answer vulnerability management questions in a customer security questionnaire with sample responses, an evidence checklist, and guidance for missing records.
CISA is ending its weekly Vulnerability Bulletin. What changes?
CISA is ending its weekly Vulnerability Bulletin as it shifts from severity-based management to risk-based prioritization. What changes for security teams?
Active vs passive vulnerability scanning: what each finds and misses
Compare active and passive vulnerability scanning: methods, blind spots, operational risks, and when to combine them for better coverage.
How forgotten subdomains become breach paths: the Novo Nordisk lesson
Exposed credentials on forgotten subdomains become breach paths. The Novo Nordisk incident shows lean teams how to control their external attack surface.
Vulnerability assessment vs vulnerability management: where the line sits
A vulnerability assessment finds problems. Vulnerability management carries each finding to verified closure. Five tests to tell a real VM tool from a scanner.
DORA compliance: what the resilience-testing and ICT-risk requirements mean for your IT team
DORA compliance for in-house IT teams: the five pillars, who's in scope, and how to produce the resilience-testing evidence auditors expect.
NIS2 vs ISO 27001: overlaps, requirements, and the gap ISO 27001 leaves open
NIS2 vs ISO 27001 compared for lean EU IT teams: where Annex A and Article 21 overlap, the incident-reporting gap ISO leaves open, and how to prove both.
NIS2 compliance: the requirements, and how to prove you meet them
What NIS2 compliance requires under Article 21, who it applies to, the fines for non-compliance, and how to produce evidence an auditor accepts.
What is a vulnerability scan? A practical guide for European IT managers
What a vulnerability scan does, how often to run one, and why the remediation lifecycle after the scan is what compliance auditors check.
The vulnerability management lifecycle: how to prove every stage happened
The 6-stage vulnerability management lifecycle and the evidence each stage must produce for ISO 27001, NIS2, and DORA auditors.
No articles match that filter. Try a different topic or clear the search.