From scattered findings to a continuous programme.

The situation

Vulnerability management needs more than a stream of scanner results. For an energy services organisation, the task was to build a continuous vulnerability management programme from scratch. It needed to connect technical findings with a repeatable way to understand exposure and report progress.

The decision

I treated vulnerability management as an operating programme, with tooling in support of it. The central questions were practical: which findings need attention, how should progress be measured, and what information helps the organisation understand its position? A consistent set of compliance KPIs gave that work a common reference point.

Making it work

The programme brought together Qualys and Tenable, SecurityScorecard and Microsoft Defender. Compliance reporting was automated in Power BI. Each source offered a different view of exposure; the programme’s purpose was to make those views useful together, rather than leave progress scattered across individual tool interfaces.

The result

The tracked compliance metrics reached approximately 99%. That figure describes the programme’s measured compliance indicators, not the proportion of all possible vulnerabilities eliminated. Automated reporting made those indicators repeatable and gave the programme a basis for tracking its position over time.

What I took forward

A dashboard is valuable when its measures support a decision. The lesson is to define what a metric means, keep its scope visible, and connect it to the work that changes the result. Vulnerability management becomes continuous through that operating discipline, with scanners providing the evidence.