Vulnerability Management Maturity Checklist
A vulnerability program is mature when the whole loop works — you know your assets, scan them well, prioritize by risk, fix within SLAs, verify the fix, and measure it all. Mark each item met, partial or not met across six areas and this checklist returns a weighted 0–100 score, per-area bars, a ranked list of your biggest gaps, and a crawl / walk / run read. It all runs in your browser.
Foundational gaps — start with inventory, coverage and basic SLAs before anything else.
Asset inventory & coverage
Scanning cadence & scope
Triage & risk-based prioritization
Remediation SLAs & tracking
Verification & retest
Metrics & reporting
- 1Not metPrioritization uses risk context (exploitation, exposure, business value), not CVSS alone.Triage & risk-based prioritization
- 2Not metCISA KEV and exploit/EPSS signals feed the priority decision.Triage & risk-based prioritization
- 3Not metA maintained inventory of assets (hosts, services, apps, repos, cloud) exists and is current.Asset inventory & coverage
- 4Not metScanning coverage is measured as a percentage of known assets, and gaps are tracked.Asset inventory & coverage
- 5Not metRemediation SLAs are defined per severity and agreed with asset owners.Remediation SLAs & tracking
- 6Not metFindings route to owners automatically as tickets with due dates.Remediation SLAs & tracking
How the score works
Each item is marked Met (1.0), Partial (0.5) or Not met (0). An area score is the weighted average of its items; the overall 0–100 is the weighted average across the six areas. Gaps are ranked by how many weighted points they still leave on the table. The result maps to a crawl / walk / run read. This is a self-assessment — nothing is uploaded or scanned.
What this tool is
- A free, in-browser maturity checklist for vulnerability management: mark each item met / partial / not met and get a weighted 0-100 score, per-area bars and a prioritized list of gaps.
- It covers six areas: asset inventory & coverage, scanning cadence & scope, triage & risk-based prioritization, remediation SLAs & tracking, verification/retest, and metrics/reporting.
- The overall score maps loosely to a crawl / walk / run read — Crawl below 45, Walk 45-74, Run 75+ — so you know whether to fix foundations or optimize.
- Gaps are ranked by weighted impact (area weight × item weight × shortfall), so the top of the list is where improvement moves the score most.
- It is a self-assessment that runs entirely in your browser: no network calls, no secrets, no scanning, and the result is exportable.
Why this matters
Most teams buy scanners first and build process later, so they end up with enormous finding counts and no reliable way to act on them. Maturity is the missing middle: the difference between generating vulnerabilities and actually reducing risk. Scoring the program across inventory, scanning, risk-based triage, SLAs, verification and metrics turns a vague sense of "we should be better at this" into a concrete, prioritized plan — and a baseline you can re-measure next quarter.
The crawl / walk / run framing keeps the advice honest: there is no point optimizing EPSS-weighted prioritization if half your assets are not even in the inventory. By ranking gaps on weighted impact, the checklist points you at the one or two changes that move maturity most — usually closing coverage gaps and putting real SLAs on findings before layering on sophistication. It is a self-assessment and planning aid, not an audit or a scan.
Frequently asked questions
What makes a vulnerability management program mature?
A mature program is not defined by how many scanners you run — it is defined by the full loop working reliably: you know your assets and your scanning coverage of them; you scan with the right depth and cadence; you prioritize by risk (exploitation, exposure, business value) rather than CVSS alone; you route findings to owners with SLAs and track them to closure; you verify fixes with a retest; and you measure the whole thing with trend metrics that actually drive decisions. This checklist scores those six areas so maturity becomes a number you can track over time.
How is the maturity score calculated?
Each checklist item is marked Met (1.0), Partial (0.5) or Not met (0) and carries a weight. An area’s score is the weighted average of its items, expressed 0-100. The overall score is the weighted average across the six areas (areas like triage/prioritization and remediation SLAs are weighted a little higher because they are where programs most often fall down). Gaps are then ranked by how many weighted points they leave on the table, so the prioritized list shows where effort pays off most.
What do crawl, walk and run mean here?
They are a simple maturity read on top of the score. Crawl (below 45) means foundational gaps — usually incomplete inventory, patchy coverage or no SLAs — and the priority is to build the basics before investing in sophistication. Walk (45-74) means the core process exists but prioritization, SLAs or verification need tightening. Run (75+) means a mature, risk-based, measured program where the focus shifts to automation depth and optimization. The bands are deliberately rough; the trend in your own score over time matters more than the exact label.
Is this an audit or does it check my systems?
No. It is a self-assessment and an educational, defensive planning aid. You answer the items yourself based on how your program actually runs; nothing is scanned, uploaded, or verified against your environment, and no data leaves your browser. Use it to get an honest internal read, to brief leadership on where the program stands, and to decide where to invest next. Re-run it quarterly and track the score.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.Educational — general guidance, not security advice.