10 Best Practices for the Modern Enterprise: Achieve Complete Attack Surface Visibility

Improving Your Cloud Security Posture with Vulnerability Remediation

Executive Summary

As an introduction to this series, this will be the second of ten series covering all 10 best practices we recommend. We covered the first one last week here, and now we're moving on to the second one.

The modern enterprise operates in a dynamic, multi-cloud, and hybrid world where the attack surface is constantly expanding and evolving. In this landscape, traditional approaches to vulnerability management—often characterized by periodic, compliance-driven scanning and patching—are no longer sufficient to protect against sophisticated cyber threats. Effective vulnerability management has transformed from a reactive IT chore into a continuous, risk-based program that is central to business resilience, data breach prevention, and operational continuity.¹ A failure to adapt to this new paradigm exposes organizations to significant financial, reputational, and regulatory risk.

This report provides business, technology, and cybersecurity leaders with a comprehensive framework for maturing their cloud security posture. It is built upon ten strategic best practices that, when implemented together, form an integrated defense against modern threats. These practices move beyond simple patching to encompass complete asset visibility, advanced risk prioritization, pervasive automation, and a foundational security culture. The core argument of this report is that a mature security program must shift its focus from merely counting patched vulnerabilities to measurably reducing business risk.

The ten best practices detailed in this report are:

1. Establish a Continuous and Comprehensive Vulnerability Management Lifecycle: Adopt a structured, cyclical process of discovery, assessment, prioritization, remediation, and verification.

2. Achieve Complete Attack Surface Visibility: Gain a unified, real-time inventory of all assets across multi-cloud and hybrid environments.
   
   
   

   

   Unstanding your Threat Exposure from 40,000 ft viewPhoto by Bernd 📷 Dittrich on Unsplash

   
   

3. Adopt a Risk-Based Prioritization Model Beyond CVSS: Focus remediation efforts on the threats that pose the greatest actual risk by incorporating threat intelligence, asset criticality, and business context.

4. Integrate Identity and Access Management (IAM) as a Primary Control Plane: utilize identity as a foundational security layer to mitigate vulnerabilities through principles such as Just-in-Time (JIT) access and adaptive controls.

5. Automate Remediation and Response with Security Orchestration: Leverage automation and SOAR capabilities to accelerate response times, reduce human error, and scale security operations.

6. Embed Security into the DevOps Lifecycle (DevSecOps): "Shift left" to identify and remediate vulnerabilities in code and infrastructure before they reach production.

7. Develop and Enforce Robust Remediation Policies and SLAs: Establish clear policies, roles, responsibilities, and timelines to ensure accountability and drive timely remediation.

8. Implement Data-Centric Security Posture Management: Discover, classify, and protect sensitive data, using data context to prioritize the most critical risks.

9. Measure, Monitor, and Mature Your Program with Actionable Metrics: Use data-driven KPIs to track progress, demonstrate value, and guide continuous improvement.

10. Foster a Security-First Culture Through Effective Reporting and Communication: Build organizational alignment and support by translating technical risk into business impact for all stakeholders.

As a Microsoft partner, this report highlights how the integrated Microsoft security ecosystem—including Microsoft Defender for Cloud, Microsoft Defender Vulnerability Management, Microsoft Entra, and Microsoft Sentinel—functions as a comprehensive Cloud-Native Application Protection Platform (CNAPP). This platform provides the necessary capabilities to implement these best practices effectively, offering a unified management plane to secure complex, multi-cloud estates spanning Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).³ This document serves as a strategic and practical roadmap for leveraging these advanced technologies to build a resilient, modern, and effective cloud security program.

---

---

2. Achieve Complete Attack Surface Visibility Across Multi-Cloud and Hybrid Environments

Strategic Imperative

Building directly upon the "Discovery" phase of the vulnerability management lifecycle, achieving complete and continuous visibility of the entire digital attack surface is a strategic imperative in its own right. An incomplete or outdated asset inventory is a primary contributor to security failures; research indicates that as many as 30% of security incidents involve unmanaged or unknown IT assets.¹² In the modern enterprise, the IT estate is no longer confined to a single, well-defined perimeter. It is a fragmented and dynamic collection of assets spanning on-premises data centers, multiple public clouds, and countless endpoints. Without a unified, real-time view of this entire estate, organizations are effectively operating with blind spots, which are precisely where attackers seek to establish a foothold. Centralized visibility is not merely a "nice-to-have" for operational efficiency; it is a fundamental prerequisite for effective risk management.

The shift to cloud computing has introduced the concept of the "elastic attack surface.".¹⁴ Unlike static on-premises environments, cloud resources are often ephemeral and provisioned on demand through auto-scaling groups and serverless functions. This means the attack surface can expand and contract in minutes, demanding a level of real-time oversight that traditional, periodic scanning tools cannot provide. Furthermore, the proliferation of "shadow IT" and unmanaged data resources creates significant risk, as these assets are not subject to standard security controls.²⁴ Therefore, a modern vulnerability management program must be built on a foundation of complete, continuous, and centralized asset discovery across all environments.

Key Concepts

Comprehensive Asset Inventory

The goal of this best practice is to identify, catalog, and document all digital assets. This inventory must be exhaustive, encompassing every piece of hardware, software, virtual machine, container, database, serverless function, API, network device, and code repository that the organization owns or operates.¹ This process must be continuous and automated to keep pace with the dynamic nature of cloud environments. A critical aspect of this inventory is its scope; it must provide a single, unified view across all on-premises, hybrid, and multi-cloud environments, including Azure, AWS, and GCP.⁶ Without this unified view, security teams are forced to manage risk through multiple, disparate consoles, which inevitably leads to inconsistent policies, operational complexity, and security gaps.

Integrating Business Context

A simple list of assets is not enough. To be truly useful for risk management, the asset inventory must be enriched with business context. This involves integrating the security inventory with a Configuration Management Database (CMDB) or other business systems to append crucial metadata to each asset.²⁵ This context should include, at a minimum, the asset owner, the business unit it belongs to, the data it processes, and its criticality to business operations. This enrichment transforms a technical list of IP addresses and hostnames into a business-centric view of the attack surface, enabling more intelligent prioritization and response. For example, knowing the owner of a vulnerable server allows for the automated creation of a remediation ticket assigned to the correct team, dramatically accelerating the response process.

Microsoft Implementation

The Microsoft security stack is architected to provide a single pane of glass for managing attack surfaces across complex, heterogeneous environments.

Microsoft Defender for Cloud as a Unified CNAPP

Microsoft Defender for Cloud is the central technology for achieving multi-cloud visibility and security. It is designed as a Cloud-Native Application Protection Platform (CNAPP) that provides a unified dashboard to discover, assess, and manage the security posture of resources across Azure, AWS, and GCP.³ This solves the critical challenge of "swivel-chair security," where analysts must pivot between multiple native cloud security consoles. By abstracting the underlying cloud provider, Defender for Cloud presents a single, consistent view of the entire cloud attack surface.

Connecting Multi-Cloud and Hybrid Environments

Defender for Cloud achieves this unified view through a combination of agentless connectors and agent-based extensions:

• Connecting AWS: Organizations can connect their AWS accounts to Defender for Cloud using a native, agentless connector deployed via a CloudFormation template. This onboarding process establishes a secure, federated authentication mechanism, enabling Defender for Cloud to scan AWS resources continuously.²⁷ This provides foundational CSPM, advanced Defender CSPM, and Cloud Workload Protection (CWP) for a wide range of AWS services, including EC2 instances, EKS clusters, and various database services.²⁹

• Connecting GCP: A similar process exists for GCP. By running a GCloud script, organizations can connect their GCP projects to Defender for Cloud, enabling protection for GKE clusters, servers, and databases within the GCP environment.³² The connection can be made at the project level, and multiple projects can be connected to single or multiple Azure subscriptions, providing flexible deployment options.³²

• Managing Hybrid Environments with Azure Arc: For on-premises servers or VMs running in other cloud environments, Azure Arc is the key enabling technology. Azure Arc extends the Azure control plane to any infrastructure, anywhere.⁵ By deploying the Azure Arc agent to on-premises servers, organizations can manage them through Defender for Cloud as if they were native Azure resources, applying the same security policies, assessments, and protections.²⁸

Deep Asset Discovery and Inventory

While Defender for Cloud provides a high-level posture management view, Microsoft Defender Vulnerability Management offers the profound, granular asset discovery needed for a comprehensive inventory. Using a combination of agent-based sensors built into operating systems and agentless network scanning, it discovers and catalogs not only traditional assets, such as servers and endpoints, but also provides detailed inventories of installed software, digital certificates, browser extensions, and even hardware and firmware.²⁰

This rich inventory data is consolidated, providing a real-time, comprehensive view of the organization's assets and forming the foundation for the entire vulnerability management lifecycle.

---

If you do not already have a cybersecurity solution for your SMB, CPF Coaching recommends Cyvatar.AI

Dedicated to simplifying cybersecurity. An all-in-one management platform that safeguards, ensures compliance, and secures without added complexity. It adapts to your business needs, collaborates with your IT team, and offers additional support via a dedicated team.

Use our referral link: https://cyvataraif5706.referralrock.com/l/CHRISTOPHE77/

---

Conclusion

A successful vulnerability management program is no longer a simple cycle of scanning and patching. It is a holistic discipline that begins with complete visibility of the attack surface across all multi-cloud and hybrid environments. It is driven by an intelligent, risk-based prioritization model that looks beyond CVSS to incorporate real-world threat intelligence and business context. It is fortified by the integration of Identity and Access Management as a primary control plane, using principles like JIT access to "virtually patch" vulnerabilities by preventing their exploitation. (And we will talk through some of these additional concepts in the upcoming series.)

Works cited

1. Vulnerability Management Lifecycle: An Easy Guide - SentinelOne, accessed June 26, 2025, https://www.sentinelone.com/cybersecurity-101/cybersecurity/vulnerability-management-lifecycle/

2. What is the vulnerability management lifecycle? - Red Canary, accessed June 26, 2025, https://redcanary.com/cybersecurity-101/security-operations/vulnerability-management-lifecycle/

3. Microsoft Defender for Cloud - CSPM & CWPP | Microsoft Azure, accessed June 26, 2025, https://azure.microsoft.com/en-us/products/defender-for-cloud

4. Microsoft Defender for Cloud Overview, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction

5. Start planning multicloud protection in Microsoft Defender for Cloud, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-multicloud-security-get-started

6. Vulnerability Management Lifecycle: 6 Steps - Swimlane, accessed June 26, 2025, https://swimlane.com/blog/vulnerability-management-lifecycle/

7. The Vulnerability Management Lifecycle Explained (5 Steps) - PurpleSec, accessed June 26, 2025, https://purplesec.us/learn/vulnerability-management-lifecycle/

8. The Vulnerability Management Lifecycle in 6 Stages | Wiz, accessed June 26, 2025, https://www.wiz.io/academy/vulnerability-management-lifecycle

9. Vulnerability Management: Components, Lifecycle & Best Practices ..., accessed June 26, 2025, https://www.exabeam.com/explainers/information-security/vulnerability-management-components-lifecycle-and-best-practices/

10. Vulnerability Management Framework - Balbix, accessed June 26, 2025, https://www.balbix.com/insights/vulnerability-management-framework/

11. Vulnerability Management Lifecycle: Key Steps for Security - Akto, accessed June 26, 2025, https://www.akto.io/learn/vulnerability-management-lifecycle

12. Why Every Vulnerability Management Strategy Starts with Asset Management - SIRP, accessed June 26, 2025, https://sirp.io/blog/why-every-vulnerability-management-strategy-starts-with-asset-management/

13. Cloud Vulnerability Management [Best Practices 2025] - Sentra, accessed June 26, 2025, https://www.sentra.io/learn/cloud-vulnerability-management

14. Azure Vulnerability Management Guide for 2025 - SentinelOne, accessed June 26, 2025, https://www.sentinelone.com/cybersecurity-101/cybersecurity/azure-vulnerability-management/

15. Vulnerability Management Lifecycle: A Comprehensive Guide - Escape.tech, accessed June 26, 2025, https://escape.tech/blog/vulnerability-management-lifecycle/

16. NIST Vulnerability Management: Defintion and Implementaion, accessed June 26, 2025, https://cynomi.com/nist/nist-vulnerability-management/

17. NIST CSF 2.0: A Framework for Vulnerability Management - SecurityBridge, accessed June 26, 2025, https://securitybridge.com/blog/nist-csf-2-0-for-vulnerability-management/

18. The NIST Cybersecurity Framework (CSF) 2.0 - NIST Technical ..., accessed June 26, 2025, https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf

19. Cloud Security Posture Management (CSPM) - Microsoft Defender for Cloud, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management

20. Microsoft Defender Vulnerability Management | Microsoft Security, accessed June 26, 2025, https://www.microsoft.com/en-us/security/business/threat-protection/microsoft-defender-vulnerability-management

21. Microsoft Defender Vulnerability Management, accessed June 26, 2025, https://learn.microsoft.com/en-us/defender-vulnerability-management/defender-vulnerability-management

22. Azure Security Control - Vulnerability Management | Microsoft Learn, accessed June 26, 2025, https://learn.microsoft.com/en-us/security/benchmark/azure/security-control-vulnerability-management

23. Vulnerability Management Best Practices - PurpleSec, accessed June 26, 2025, https://purplesec.us/learn/vulnerability-management-best-practices/

24. Overview - Data security posture management - Microsoft Defender for Cloud, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-data-security-posture

25. PowerBI Dashboard - SQL Queries - Rapid7 Discuss, accessed June 26, 2025, https://discuss.rapid7.com/t/powerbi-dashboard/41520

26. Microsoft Defender for Cloud - CSPM & CWPP | Microsoft Azure, accessed June 26, 2025, https://azure.microsoft.com/en-us/products/defender-for-cloud/

27. Connect your AWS account - Microsoft Defender for Cloud ..., accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws

28. Steps to Integrate Microsoft Defender for Cloud with AWS Account — Enable Defender for Servers | by Poojashetty | KPMG UK Engineering | Medium, accessed June 26, 2025, https://medium.com/kpmg-uk-engineering/steps-to-integrate-microsoft-defender-for-cloud-with-aws-account-enable-defender-for-servers-b2110d6be0f6

29. Protect your Amazon Web Services (AWS) containers with Defender for Containers, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-enable-container-aws

30. Microsoft Security for AWS - Azure Architecture Center, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/architecture/guide/aws/aws-azure-security-solutions

31. Enable Defender for open-source relational databases on AWS (Preview) - Learn Microsoft, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-defender-for-databases-aws

32. Connect your GCP project - Microsoft Defender for Cloud | Microsoft ..., accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-gcp

33. Protect your Google Cloud Platform (GCP) containers with Defender for Containers, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-enable-container-gcp

34. Defender For Vulnerability Management - Microsoft Security, accessed June 26, 2025, https://secureazcloud.com/f/defenderforvulneralibilitymanagement

35. Vulnerability Management Resources - SANS Institute, accessed June 26, 2025, https://www.sans.org/blog/vulnerability-management-resources/

36. Beyond CVSS: Smarter Vulnerability Prioritization with Exploit Data ..., accessed June 26, 2025, https://www.recastsoftware.com/resources/beyond-cvss-smarter-vulnerability-prioritization/

37. Strategic Recommendation for Transitioning from CVSS to Risk-Based Vulnerability Prioritization - Netpoleon Solutions, accessed June 26, 2025, https://www.netpoleons.com/blog/strategic-recommendation-for-transitioning-from-cvss-to-risk-based-vulnerability-prioritization

38. Risk-Based Vulnerability Management: Prioritize What Matters | Wiz, accessed June 26, 2025, https://www.wiz.io/academy/risk-based-vulnerability-management

39. What is Vulnerability Prioritization? And how to do it right - JAMF Software, accessed June 26, 2025, https://www.jamf.com/blog/vulnerability-prioritization-guide-for-it-experts/

40. CVSS 4.0 and Beyond: A Context-Aware Approach to Vulnerability ..., accessed June 26, 2025, https://www.armis.com/blog/cvss-4-0-and-beyond-a-context-aware-approach-to-vulnerability-risk-assessment/

41. What Is Vulnerability Prioritization? Strategies and Steps - Legit Security, accessed June 26, 2025, https://www.legitsecurity.com/aspm-knowledge-base/vulnerability-prioritization

42. What Is Vulnerability Prioritization? - Picus Security, accessed June 26, 2025, https://www.picussecurity.com/resource/glossary/what-is-vulnerability-prioritization

43. NIST SP 800-53r5 Compliance Guide | Vulnerability Management Best Practices - Brinqa, accessed June 26, 2025, https://www.brinqa.com/blog/nist-800-53-vulnerability-management/

44. Vulnerabilities by ACR - Tenable documentation, accessed June 26, 2025, https://docs.tenable.com/cyber-exposure-studies/application-software-security/Content/VulnerabilitiesACR.htm

45. Risk Prioritization - Tenable documentation, accessed June 26, 2025, https://docs.tenable.com/cyber-exposure-studies/cyber-exposure-insurance/Content/RiskPrioritization.htm

46. Discover Your Most Critical Assets Before Hackers Do | HackerNoon, accessed June 26, 2025, https://hackernoon.com/discover-your-most-critical-assets-before-hackers-do

47. What is Vulnerability Prioritization? | Bitsight, accessed June 26, 2025, https://www.bitsight.com/learn/vulnerability-prioritization

48. Vulnerability Assessment Report: A C-Suite Guide — KEYCALIBER, accessed June 26, 2025, https://www.keycaliber.com/resources/-vulnerability-assessment-report-a-c-suite-guide

49. Why Vulnerability Assessment Reports Fail (& How To Fix It) - PurpleSec, accessed June 26, 2025, https://purplesec.us/learn/vulnerability-assessment-reporting/

50. Why an IAM Assessment is Crucial for Your Cybersecurity Strategy, accessed June 26, 2025, https://www.identityfusion.com/blog/why-an-iam-assessment-is-crucial-for-your-cybersecurity-strategy

51. What is Identity Access Management (IAM)? - CrowdStrike, accessed June 26, 2025, https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/identity-access-management-iam/

52. The Role of IAM in Preventing Cyber Attacks - Infisign, accessed June 26, 2025, https://www.infisign.ai/blog/the-role-of-iam-in-preventing-cyber-attacks

53. The Importance of Identity and Access Management in Safeguarding Your Enterprise, accessed June 26, 2025, https://www.infosecurity-magazine.com/blogs/identity-access-management/

54. What is Privileged Identity Management? - Microsoft Entra ID ..., accessed June 26, 2025, https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

55. Microsoft Security - Privileged Identity Management (PIM), accessed June 26, 2025, https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-privileged-identity-management-pim

56. Microsoft Entra Conditional Access | Microsoft Security, accessed June 26, 2025, https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-conditional-access

57. Configure Microsoft Entra for increased security (Preview), accessed June 26, 2025, https://learn.microsoft.com/en-us/entra/fundamentals/configure-security

58. Microsoft Entra ID (formerly Azure Active Directory) | Microsoft Security, accessed June 26, 2025, https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id

59. Learn about privileged access management | Microsoft Learn, accessed June 26, 2025, https://learn.microsoft.com/en-us/purview/privileged-access-management

60. Beware the Hidden Risk in Your Entra Environment - The Hacker News, accessed June 26, 2025, https://thehackernews.com/2025/06/beware-hidden-risk-in-your-entra.html

61. Microsoft nOAuth Flaw Still Exposes SaaS Apps Two Years After Discovery, accessed June 26, 2025, https://www.infosecurity-magazine.com/news/microsoft-noauth-flaw-2025/

62. What is Automated Vulnerability Remediation? - SentinelOne, accessed June 26, 2025, https://www.sentinelone.com/cybersecurity-101/cybersecurity/what-is-automated-vulnerability-remediation/

63. What Is Automated Vulnerability Remediation? | Benefits & Best Practices for Security Teams - Brinqa, accessed June 26, 2025, https://www.brinqa.com/blog/automated-vulnerability-remediation/

64. Automate Threat Response with Playbooks in Microsoft Sentinel ..., accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/sentinel/automation/automate-responses-with-playbooks

65. Vulnerability Management Automation: Here's Why You Need it - Swimlane, accessed June 26, 2025, https://swimlane.com/blog/automating-vulnerability-lifecycle-management/

66. Vulnerability Management in Microsoft Azure - NubOps, accessed June 26, 2025, https://www.nubops.com/blog/2024/02/22/vulnerabilities/

67. Automating Threat Detection and Response with Microsoft Sentinel Playbooks - ne Digital, accessed June 26, 2025, https://www.nedigital.com/en/blog/automating-threat-detection-and-response-with-microsoft-sentinel-playbooks

68. Automation in Microsoft Sentinel, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/sentinel/automation/automation

69. Automate threat response with playbooks in Microsoft Sentinel - GitHub, accessed June 26, 2025, https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/sentinel/automation/automate-responses-with-playbooks.md

70. Azure Logic Apps | Microsoft Azure, accessed June 26, 2025, https://azure.microsoft.com/en-us/products/logic-apps

71. Overview - Azure Logic Apps | Microsoft Learn, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-overview

72. Automated remediation in Azure - Netskope Community, accessed June 26, 2025, https://community.netskope.com/security-posture-management-4/automated-remediation-in-azure-5876

73. Mastering SANS Vulnerability Management: A Comprehensive Guide - Astra Security, accessed June 26, 2025, https://www.getastra.com/blog/compliance/sans/sans-vulnerability-management/

74. Vulnerability Management Policy: 3 Examples and 6 Best Practices | Sternum IoT, accessed June 26, 2025, https://sternumiot.com/iot-blog/vulnerability-management-policy-3-examples-and-6-best-practices/

75. Best Practices for SLA Vulnerability Management - FortifyFramework.com, accessed June 26, 2025, https://www.fortifyframework.com/sla-vulnerability-management/

76. Nucleus Blog | Adapt Vulnerability Management Service Level ..., accessed June 26, 2025, https://nucleussec.com/blog/how-to-adapt-vulnerability-management-service-level-agreements-to-team-maturity/

77. How Soon Should Vulnerabilities Be Patched? - Tandem, accessed June 26, 2025, https://tandem.app/blog/how-soon-should-vulnerabilities-be-patched

78. Vulnerability Management SLAs: A Guide - HostedScan.com, accessed June 26, 2025, https://hostedscan.com/blog/vulnerability-management-slas-guide

79. Vulnerability Remediation | safecomputing.umich.edu, accessed June 26, 2025, https://safecomputing.umich.edu/protect-the-u/protect-your-unit/vulnerability-management/remediation

80. FortifyData's Alignment with NIST SP 800-40, accessed June 26, 2025, https://fortifydata.com/blog/fortifydata-alignment-with-nist-sp-800-40/

81. Microsoft Defender Vulnerability Management Plans and Pricing, accessed June 26, 2025, https://www.microsoft.com/en-us/security/business/threat-protection/microsoft-defender-vulnerability-management-pricing

82. Top 10 Vulnerability Management Metrics & KPIs To Measure Success, accessed June 26, 2025, https://purplesec.us/learn/vulnerability-management-metrics/

83. 15 Vulnerability Management Metrics to Measure your Program - Wiz, accessed June 26, 2025, https://www.wiz.io/academy/vulnerability-management-metrics

84. Vulnerability Management Reports | Rootshell Security, accessed June 26, 2025, https://www.rootshellsecurity.net/vulnerability-management-reports/

85. Using the SANS Vulnerability Management Maturity Model in Your Vulnerability Management Process - RH-ISAC, accessed June 26, 2025, https://rhisac.org/vulnerability-management/sans-maturity-model-process/

86. 15 Key Vulnerability Management Metrics for Success - Legit Security, accessed June 26, 2025, https://www.legitsecurity.com/aspm-knowledge-base/top-vulnerability-management-metrics

87. Vulnerability Management Metrics: 5 Metrics to Start Measuring in ..., accessed June 26, 2025, https://www.sans.org/blog/5-metrics-start-measuring-vulnerability-management-program/

88. Automated Remediation: Benefits, Best Practices & Use Cases - Tamnoon, accessed June 26, 2025, https://tamnoon.io/blog/automated-cloud-remediation-guide/

89. How to report on vulnerability management to the board - Intruder.io, accessed June 26, 2025, https://www.intruder.io/blog/reporting-to-the-board-how-to-talk-about-vulnerability-management

90. Vulnerability Dashboard using Microsrft Power BI - YouTube, accessed June 26, 2025,

1. How to Create a Custom Security & Threat Dashboard in Power BI, accessed June 26, 2025, https://www.techrepublic.com/article/how-to-visualise-security-and-threat-information-in-power-bi/

2. RAPID 7 as a source for Vulnerabilities dashboard - Microsoft Fabric Community, accessed June 26, 2025, https://community.powerbi.com/t5/Desktop/RAPID-7-as-a-source-for-Vulnerabilities-dashboard/td-p/2284223