Vulnerability Management for SMEs: Scanning, Prioritising and Targeted Patching

Every week, someone somewhere in the world publishes a list of new vulnerabilities in software you almost certainly use as well. Microsoft, Fortinet, Citrix, WordPress plugins, the VPN appliance in your office. You can't possibly patch everything straight away, and you don't need to. Vulnerability management is the discipline that lets you pick out exactly the vulnerabilities that matter to your business from that stream, and fix them fast enough to stay ahead of attackers.

What exactly is vulnerability management?

Vulnerability management is the continuous process of discovering, assessing, prioritising, remediating and verifying vulnerabilities in your IT environment. It's broader than patch management: patching is one of the outcomes of the process, alongside configuration changes, extra firewall rules, disabling legacy protocols or accepting residual risk under defined conditions.

The difference lies in the question you ask. Patch management asks: "Which updates are ready, and when do we roll them out?" Vulnerability management asks: "Which weaknesses does my business have right now, how serious are they really in my context, and what am I going to do about each one?" Patching is part of a good answer. What patch management is and why it's crucial explains the patching side; this article covers the wider process around it.

Why SMEs need to take this seriously

In Verizon's 2025 Data Breach Investigations Report, exploitation of vulnerabilities accounted for 20 per cent of all data breaches, an increase of 34 per cent on the previous year. Credential abuse sat just above it at 22 per cent, with phishing just below at 16 per cent. Even more striking: exploits against edge devices and VPN appliances made up 22 per cent of all vulnerability incidents, up from just 3 per cent a year earlier.

This isn't just a problem for big corporations. The firewalls, routers and VPN boxes targeted by these kinds of attacks sit in SME offices too. And attackers scan the entire internet, not just the Fortune 500. When a critical vulnerability in a widely used device goes public, automated exploitation follows worldwide within hours.

On top of that comes legislation. Under the Cyberbeveiligingswet (the Dutch Cybersecurity Act, the Netherlands' implementation of NIS2), essential and important entities must be able to demonstrate that their vulnerability management is in order. See our complete NIS2 guide for Dutch SMEs for what that means for you in concrete terms.

The five steps in the process

A workable cycle for an SME looks like this.

1. Discover: know what you have

You can't secure what you don't know about. Start with an inventory of all your assets: servers, workstations, network equipment, cloud subscriptions, SaaS applications, mobile devices, and the often-forgotten IoT and OT equipment (printers, cameras, access control). Only then will scanners tell you anything meaningful. Keep the inventory updated automatically from your endpoint management and your identity provider, or it'll be out of date again within a month.

2. Scan: find the weak spots

Scanners translate your asset list into discovered vulnerabilities. There are broadly three types:

• Authenticated scans of servers and workstations via an agent or credentials.
• External scans from the internet against your public IP ranges and domains.
• Cloud posture scans that assess your Microsoft 365, Azure or Google Workspace configuration.

Combine these sources, because each one sees a different part of your environment. Run internal scans at least weekly, external scans daily on critical exposure, and cloud posture continuously via your providers' APIs.

3. Prioritise: not everything is urgent

This is the difference between a spreadsheet with a thousand items and an achievable action plan. A CVSS score of 9.8 only tells you how bad something could be at most, not how likely it is to be exploited or how critical the asset is.

So combine three signals:

1. CVSS for technical severity.
2. EPSS from FIRST for the probability of exploitation within 30 days, as a number between 0 and 1.
3. The CISA KEV catalogue for vulnerabilities known to be actively exploited.

Then multiply that by your own context: is the asset exposed to the internet, does it hold customer data, are there compensating controls? A CVSS 9.0 vulnerability on an offline developer machine with no internet connection is less urgent than a CVSS 7.0 on your public VPN gateway that's listed in the KEV catalogue.

4. Remediate: patch, reconfigure or accept

For each prioritised item, you choose one of four routes.

• Patch if a vendor patch exists and can be applied quickly.
• Change the configuration if disabling a feature or adding a firewall rule removes the risk.
• Compensate with extra monitoring, segmentation or WAF rules if patching isn't immediately possible.
• Accept with a sign-off, for residual risk the business knowingly takes on.

Record the decision. An accepted risk without documentation is simply a forgotten risk.

5. Verify: don't trust, check

After every remediation, scan again to confirm the vulnerability has really gone. A patch that stalled somewhere, a VM that didn't restart, a clone with an old agent: it happens more often than you'd think. Without this step, your reports are fiction.

Realistic SLAs per priority

No official standard dictates exact timeframes for SMEs. In practice, these timeframes work for most businesses, provided you record in your risk acceptance policy that you'll stick to them:

• Critical and actively exploited (for example, listed in the KEV catalogue): within 24 to 72 hours.
• High risk on internet-facing assets: within 7 days.
• High risk internally: within 30 days.
• Medium: within 60 to 90 days, in the regular patch cycle.
• Low: in the next quarterly cycle, or accept.

What counts is that you meet them. SLAs that are systematically missed are wishful thinking on paper, not security policy.

Metrics that genuinely help you steer

Track these figures monthly in a simple dashboard:

• Scan coverage: the percentage of assets successfully scanned in the past week.
• MTTR per severity: mean time to remediate, broken down into critical, high and medium.
• Open critical age: how long critical items stay open on average.
• KEV exposure: the number of assets with an open vulnerability from the CISA KEV catalogue.
• Patch compliance: the percentage of devices on the latest approved baseline.

A trend heading the wrong way tells you more than a single measurement. If your MTTR for critical items doubles in two months, something structural is going on: too few maintenance windows, an overloaded team or tooling that isn't working.

Tooling for SMEs in practice

Mature enterprise tools such as Tenable, Qualys and Rapid7 are excellent, but often overkill in price and complexity for an SME with 25 to 150 employees. In practice, a layered stack works well:

• Microsoft Defender Vulnerability Management if you already run Microsoft 365 Business Premium or E3/E5. It's included, sees every Windows device enrolled in Intune and integrates with Defender for Endpoint. See our guide to Microsoft Intune for SMEs for how to roll out the agents.
• OpenVAS or Nessus Essentials for internal network scans, as a complement or alternative.
• CrowdStrike, SentinelOne or Defender for Endpoint for endpoint detection plus built-in vulnerability insights.
• An external attack surface management service for what you expose to the internet.

What you should never do is buy three tools without assigning someone to work with them. A scan without follow-up isn't security; it's a report.

Where SMEs often go wrong

We see a few patterns again and again.

• Scans run, but nobody acts on them. The tool reports a thousand findings every month, everyone feels overwhelmed and nobody picks them up.
• Edge devices get forgotten. The Fortinet, SonicWall or Cisco ASA at the edge of the network barely gets its firmware updates. That's exactly where zero-day exploits land.
• No asset owner per system. If there's a vulnerability in the accounting server and nobody knows who patches it, it doesn't get patched.
• OS only, no application layer. Windows updates run like clockwork, but the WordPress plugins, Node modules and PDF viewer sit untouched. Those are precisely what gets exploited at scale.
• No testing routine for patches. Patching production on a Friday without testing first is a recipe for a Monday-morning problem.

How to get started if you have nothing yet

If you're starting from zero, you won't roll out an enterprise stack in week one. A 90-day plan works better.

1. Weeks 1-2: inventory all assets. Make a flat list of servers, laptops, network equipment, cloud tenants and SaaS. Assign an owner to each cluster.
2. Weeks 3-4: switch on a first scanner for your internal network and your external IP ranges. Use what you already have (Defender if you have M365 Business Premium). Record a baseline.
3. Month 2: define your SLAs per severity, choose your prioritisation model and document who decides on accepting or compensating.
4. Month 3: start a weekly remediation review. The first hour of every Monday: what's critical, who's picking up what, and what's been closed since last week. Track your metrics.

After these 90 days, it's no longer a one-off project but a process. Our managed IT services include this cycle as standard for clients who don't want to spend every Monday chasing new CVEs themselves.

Frequently asked questions about vulnerability management

What's the difference between vulnerability management and patch management? Patch management is the process of testing and rolling out software updates. Vulnerability management is broader: it starts with discovering weaknesses, prioritises them by risk and decides case by case whether patching, reconfiguring, compensating or accepting is the right response. Patch management is one of its outcomes.

How often should you scan? Internal authenticated scans at least weekly, external scans daily on internet-facing systems, and cloud posture continuously via the API. For high-risk environments such as OT in production, passive scans outside production hours are wiser than aggressive active scans.

Do we need Nessus or Qualys if we already have Microsoft 365? Not necessarily. Microsoft Defender Vulnerability Management is included in Microsoft 365 Business Premium and higher licences, and covers Windows, macOS and Linux endpoints enrolled in Defender for Endpoint. For network equipment and non-Microsoft servers, you'll often need an additional scanner.

What is EPSS, and why should I use it? EPSS, FIRST's Exploit Prediction Scoring System, gives every CVE an estimate (between 0 and 1) of the probability of active exploitation within 30 days. Combined with CVSS and the CISA KEV catalogue, it stops you ending up with 300 "critical" items of which 290 will never be attacked.

How much should an SME spend on vulnerability management each year? It depends on scope and maturity. A 50-person SME that has vulnerability management carried out as part of managed IT services usually pays a monthly fee that also covers monitoring, patching and the helpdesk. Standalone tool licences can quickly cost several tens of thousands of euros a year; the real work lies in the follow-up.

Is this mandatory for us under NIS2? If you fall under the Cyberbeveiligingswet (the Dutch Cybersecurity Act) as an essential or important entity, you must have demonstrable vulnerability management as part of your duty of care. Even if you don't formally fall under NIS2, customers and suppliers will increasingly write it into their contracts.

Conclusion

Vulnerability management isn't about closing every single port. It's the discipline that decides where to invest your limited maintenance capacity, so you close the weak spots attackers actually use. An SME with a discovery, scanning, prioritisation and remediation cycle that runs every week, with clear owners and SLAs, is better protected than a competitor with a pricier scanner that nobody looks at.

If you'd rather not chase this cycle yourself every week, we'll take it off your hands. Our managed IT engineers monitor your environment, work with you to prioritise what needs doing each week and share the results in a clear monthly report. Curious what that would cost for your environment? Book a no-obligation call via our contact page or call us directly on +31 85 303 5869.