## The Vulnerability Lifecycle

Vulnerability Management (VM) is not just "Scanning". It is a process.

### 1. Discovery
*   Asset Inventory. You can't scan what you don't know exists.
*   "We found a rogue Raspberry Pi on the network."

### 2. Prioritization
*   Scanner says: "Critical Bug on Server A (Test) and Server B (Production)".
*   **Context**: Server B exposes patient data. Server A is empty. Fix B first.

### 3. Remediation
*   **Patch**: Install the update.
*   **Mitigate**: Cannot patch (Legacy App)? Add a Firewall rule (Virtual Patch).
*   **Accept**: "The risk is low, fixing it costs $1M. We accept the risk." (Must be signed by Exec).

### 4. Verification
*   Re-scan. "Did the patch actually work?"

### The Time Gap
**Window of Exposure**: The time between the bug discovery (Day 0) and the Patch applied (Day 30).
Your goal is to shrink this window.