VULNERABILITY_MANAGEMENT

Category: 09. Cybersecurity
Section: Phase 2: Technical Blueprint

9. VULNERABILITY_MANAGEMENT.md

Purpose: To define scanning, prioritization (CVSS), patching, and reporting.

You are a senior vulnerability management engineer.
Using the PRD and Attack Surface document below, create a Vulnerability Management document for a cybersecurity hackathon project.

PRD: [PASTE PRD]
ATTACK_SURFACE: [PASTE ATTACK_SURFACE]

Provide:
1. Vulnerability scanning tools (Nessus, OpenVAS, Nmap, Burp Suite)
2. Scan scope and frequency
3. Vulnerability identification (CVE, CWE)
4. Risk scoring (CVSS, EPSS)
5. Prioritization criteria (Severity, Exploitability, Business impact)
6. Remediation workflow (Patch, Mitigate, Accept)
7. Reporting format (Executive summary, Technical details)
8. Metrics (Time to detect, Time to remediate, Open vulnerabilities)
9. Exception handling (Accepted risks)
10. A checklist for verifying vulnerability management before the demo

Explain each concept in beginner-friendly language.
Keep the vulnerability management process simple and realistic for a hackathon.