Vulnerability Management for a Small Business: Scanning and Patching That Actually Happens

TL;DR: Vulnerability management for a small team is a loop: know what you own, scan it, rank findings by real exposure, fix, and check the fix held. Start with CISA's free list of vulnerabilities attackers already use, patch on a monthly rhythm, and isolate and document anything you cannot patch.

Vulnerability management for a small business is not a scanner subscription. Plenty of small teams already have a scan report somewhere. What they often lack is a short list of what to fix this week, a person who owns it, and a way to know the fix stuck.

Good news: the free public signals for building that short list are better than most owners realize. Here is the whole vulnerability management loop, with real numbers and the order I would do it in.

What is a vulnerability test, and what is vulnerability management?

A vulnerability test, usually called a vulnerability scan or assessment, checks your systems against a database of known weaknesses: outdated software, missing updates, risky settings. It tells you what might be wrong. A penetration test goes further and proves what an attacker could actually do with it; we cover that in our penetration testing guide.

Vulnerability management is everything after the scan. NIST, the federal standards agency, describes enterprise patch management as "identifying, prioritizing, acquiring, installing, and verifying the installation of patches, updates, and upgrades throughout an organization." (NIST SP 800-40 Rev. 4) Notice that scanning is one word in that sentence. Prioritizing, installing and verifying are the other three, and they are where vulnerability management actually happens.

NIST also frames it the way I would explain it to any owner: patching "should be considered a standard cost of doing business and should be rigorously followed and tracked," the same way "preventive maintenance on corporate fleet vehicles can help avoid costly breakdowns."

Why do scan reports pile up without getting fixed?

Because finding is fast and fixing takes a person's time, and that is where vulnerability management usually stalls. Verizon's 2026 Data Breach Investigations Report found that exploitation of vulnerabilities "is now the most common initial access vector for breaches," at 31%. Then the part that matters for this post: "Only 26% of critical vulnerabilities," meaning the ones on CISA's list of vulnerabilities known to be exploited, "were fully remediated by organizations in 2025," down from 38%, and the median time to fully fix them rose to 43 days. (Verizon DBIR 2026, executive summary)

The Massachusetts picture says the same thing in local numbers. The state's Office of Consumer Affairs and Business Regulation and the MassCyberCenter studied breaches reported for 2024. Of 938 system intrusions, 711 stemmed from internet-facing vulnerabilities, which the report defines to include "internet-facing software that has not been updated" and VPNs with known holes. (OCABR and MassCyberCenter, May 2026)

Put those side by side. The doors attackers use are mostly known and fixable. The gap is follow-through, which is exactly what vulnerability management is for.

What does the vulnerability management loop look like for a small business?

Five steps of vulnerability management. Skip one and the scan report becomes shelfware.

1. Inventory. List every device, server, cloud account, website, firewall, VPN and piece of software you run. NIST is blunt that the old habit of updating inventories "on a monthly or quarterly basis by performing a vulnerability scan" is outdated: "That model should no longer be used." Keep the list current as things change, not once a quarter; vulnerability management cannot fix what it does not know about.
2. Scan. The CIS Controls, a widely used security baseline from the nonprofit Center for Internet Security, set the cadence: scan internal systems "on a quarterly, or more frequent, basis" and internet-facing systems "on a monthly, or more frequent, basis." (CIS Controls v8.1, Control 7) Do not forget the software libraries inside your own apps; we track those as supply chain security.
3. Rank. Sort findings by what an attacker can actually reach and use, not by the raw score on the report. The next section is how.
4. Fix. Patch, upgrade, change the setting, or remove the thing. Give every finding an owner and a date.
5. Verify. Rescan and confirm the fix took effect. NIST notes that verification at scale generally needs automated means. Then track open findings month over month so you can see whether your vulnerability management is keeping up.

For a small office, steps one and two are mostly setup. Steps three to five are the real vulnerability management work, every month.

How do you rank vulnerabilities by real exposure instead of CVSS?

Most scan reports sort by CVSS, the 0 to 10 severity score. FIRST, the standards body behind it, states in its CVSS 4.0 FAQ that "CVSS-B Base scores are not risk, and should not be used alone for patch prioritization." (FIRST, CVSS v4.0 FAQ)

For small business vulnerability management, three free public signals do a much better job. Use them together.

1. CISA's Known Exploited Vulnerabilities catalog

CISA, the federal cybersecurity agency, keeps what it calls "the authoritative source of vulnerabilities that have been exploited in the wild." An entry needs a CVE ID, "reliable evidence that the vulnerability has been actively exploited in the wild," and "a clear remediation action." CISA's advice: "Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework." (CISA KEV)

On October 21, 2026, the catalog held 1,754 entries. The National Vulnerability Database held 394,502 published CVE records, not counting rejected ones. (CISA KEV catalog, NIST NVD) That is under half of one percent. FIRST's own estimate agrees: KEV "lists roughly 0.5% of published CVEs." (FIRST, EPSS FAQ)

In CISA's data file, 361 of those entries are marked as used in ransomware campaigns. If your scanner can filter by KEV, start your vulnerability management there. Every KEV finding on an internet-facing system goes to the top.

2. EPSS, the exploit prediction score

KEV tells you what has been exploited. EPSS estimates what will be. FIRST describes it as a model that estimates "the probability a vulnerability will be exploited in the wild within the next 30 days," and publishes the scores free every day. (FIRST, EPSS)

Read the number carefully. FIRST notes the base rate is low: in any 30-day window, roughly 2.5 to 3% of published CVEs show exploitation activity. So a 5% score "is ranked in the top 10% of all published vulnerabilities." A 50% cutoff sounds sensible and is not; FIRST warns it would deprioritize 98.8% of everything. (FIRST, Using EPSS) FIRST also says plainly that "EPSS is not a complete risk score," because it knows nothing about your systems. That part is your job, and it is the part of vulnerability management no feed can do for you.

3. Your own exposure

In June 2026 CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk." It binds federal civilian agencies, not private companies, but the logic transfers cleanly to small business vulnerability management. It ranks each vulnerability on four questions: asset exposure, KEV status, exploit automation, and post-exploitation technical impact. (CISA, June 10, 2026) CISA "strongly encourages all partners to adopt similar actions."

The result is striking. In one large agency, CISA found "only 1% of vulnerability instances fall into the three-day category," with "over 60% of the vulnerability instances deferred to the next system upgrade." (CISA, Patch Smarter, Not Harder) Reporting on the directive describes the same split: a vulnerability that checks all four boxes gets three days, and roughly 60% can wait. (Nextgov, August 2026)

That is the permission most small teams need. Vulnerability management does not mean you fix 400 findings this week. You have to fix the exposed, exploited few, fast.

A simple vulnerability management ranking a small business can run

• This week: anything on the KEV list that is reachable from the internet. Firewalls, VPNs, remote access tools, your website and its plugins, email servers.
• This month: KEV items on internal systems, and internet-facing items with a high EPSS score.
• Next scheduled update: everything else, picked up by your normal monthly patching.

To read a single CVE in plain English before you decide, we built a CVE explainer on kief.dev (opens in a new tab). For a worked example of ranking by real use instead of score, see every CVE in lodash, ranked by how much you should actually care (opens in a new tab).

How often should a small business patch?

Monthly, with a fast lane for emergencies. The vulnerability management rhythm is already set for you:

• Microsoft publishes its monthly security update "on the second Tuesday of each month," and ships out-of-band fixes when something cannot wait. (Microsoft Learn)
• CIS Controls call for operating system and application updates "through automated patch management on a monthly, or more frequent, basis," and for remediating detected vulnerabilities on the same monthly rhythm.
• NIST separates routine patching from emergency patching, and warns that routine patching "is often postponed and neglected," which "provides many additional windows of opportunity for attackers." Its advice is to allow some flexibility "while also forcing installation after a grace period has ended."

A practical vulnerability management calendar for a small office: updates install automatically on laptops within a week of release, servers and firewalls get a scheduled window the weekend after Patch Tuesday, and a KEV item on an internet-facing system gets patched within days, outside the schedule. For federal agencies, BOD 26-04's fastest deadline is three days. That is a fair benchmark for your riskiest few.

One vulnerability management step people skip: after an emergency patch, check whether anyone got in first. CISA's reasoning is simple: "Applying a patch generally does not evict a threat actor."

What do you do with systems you cannot patch?

Every small business has one: the old PC running a lab instrument, or the phone system the vendor stopped updating.

CISA lists unsupported, end-of-life software on its short list of Bad Practices and says it "is especially egregious in technologies accessible from the Internet." (CISA, Bad Practices) The state's breach report says the same about legacy IT: once vendors stop updating it, "any vulnerabilities will not be patched."

NIST gives four options for any vulnerability you cannot patch right away: accept, mitigate, transfer or avoid. In plain terms:

1. Take it off the internet. Nothing unpatchable should be reachable from outside. That one move removes it from the top of the list.
2. Isolate it. NIST's example is "using firewalls and network segmentation to isolate vulnerable assets." Its own sample plan for legacy equipment lists "Network isolation, physical security controls."
3. Turn off what you do not need. Disabling a vulnerable feature or service counts as mitigation.
4. Write down the exception. CIS Safeguard 2.2 says unsupported software that you still need gets "an exception detailing mitigating controls and residual risk acceptance," reviewed at least monthly. One paragraph per system: what it is, why it stays, how it is isolated, who signed off.
5. Set a replacement date. Isolation buys time, not forever. I wrote about how often a business should replace its computers (opens in a new tab).

What does a vulnerability assessment cost for a small business?

I looked for a reputable published survey of what small businesses pay for a vulnerability assessment or ongoing vulnerability management. I did not find one. The figures online come from firms selling the service, so I will not repeat them. What I can give you is what moves the cost of vulnerability management:

• How many things you own. Twenty laptops and one website take less time than three offices and a custom app.
• Authenticated or not. A scan that logs in sees far more than one that only knocks on the door, and takes more setup. CIS calls for both on internal systems.
• Who fixes it. Scanning is the cheap part of vulnerability management. The hours go into ranking, patching, testing and verifying.
• The starting point. The first month, with the oldest backlog, is the expensive one.

How should a Worcester-area small business start vulnerability management?

Massachusetts already expects the basics. The state's data security regulation, 201 CMR 17.00, requires that systems holding personal information and connected to the internet have "reasonably up-to-date firewall protection and operating system security patches," and security software "set to receive the most current security updates on a regular basis." (201 CMR 17.04) If you keep customer or employee records, that is likely you.

Here is a 30-day vulnerability management plan a dental office in Shrewsbury or a machine shop in Worcester might run:

1. Days 1 to 5: inventory. Write down every internet-facing thing first: website, firewall, VPN, remote access, email. Then the rest.
2. Days 6 to 10: scan. External first, then internal with credentials.
3. Days 11 to 15: rank. Filter by KEV. Anything KEV and internet-facing goes to the top, then sort the rest with EPSS.
4. Days 16 to 25: fix and isolate. Patch the top of the list. Pull anything unpatchable off the internet and write its exception.
5. Days 26 to 30: verify and set the rhythm. Rescan, confirm, and put the monthly vulnerability management cycle on the calendar the week after Patch Tuesday.

Amelia, my wife and Kief Studio's co-founder and CEO, wrote about the first five cybersecurity steps for a small business (opens in a new tab). Patching is on it for good reason.

This article is general information, not legal advice. Kief Studio is not a law firm, and reading it does not create an attorney-client relationship. Laws and regulations change, so check the current text and talk with a licensed Massachusetts attorney about your situation.