How to Build a Vulnerability Management Program on a $0 Budget

Security on a Shoestring

You're a small team. Maybe a startup, maybe a side project that's gaining traction, maybe a small company with no dedicated security person. You know vulnerabilities matter, but your budget says otherwise.

Good news: you can build a credible vulnerability management program with free tools, public data, and a few hours of setup time.

Step 1: Know What You Run

You can't protect what you don't know about. Start with an inventory:

Application Dependencies

• Run npm audit, pip audit, composer audit, or cargo audit in your repos
• Check your package-lock.json, Pipfile.lock, or equivalent for the full dependency tree
• Document your direct dependencies and their versions

Infrastructure

• List your servers, containers, and cloud services
• Note OS versions, web servers, databases, and runtimes
• Don't forget managed services, they have vulnerabilities too

Third-Party Services

• SaaS tools you depend on
• APIs you integrate with
• WordPress plugins, browser extensions, or anything else in your supply chain

A spreadsheet works. A CMDB is better. Even a text file is better than nothing.

Step 2: Set Up Free Monitoring

GitHub Dependabot (free for all GitHub repos)

Enable Dependabot alerts and security updates. It automatically scans your dependency manifests and opens PRs for vulnerable packages.

Trivy (open source)

Container and filesystem vulnerability scanner. Run trivy image your-image:latest in CI/CD to catch known CVEs in your container base images and installed packages.

OWASP Dependency-Check (open source)

Language-agnostic SCA tool that checks your project dependencies against the NVD.

Our Free Tier

Declare your stack on vulneraibility.com and get AI-filtered CVE alerts for major threats. No credit card required for the free tier.

Step 3: Establish a Triage Process

Alerts without a process are just noise. Define how you handle incoming vulnerability reports:

Severity Thresholds

• Critical (CVSS ≥ 9.0 or KEV-listed): Triage within 24 hours. Patch within 7 days.
• High (CVSS 7.0–8.9): Triage within 1 week. Patch within 30 days.
• Medium/Low: Batch into regular maintenance cycles.

Decision Tree

For each vulnerability, answer:

1. Does it affect software we actually run? → If no, close.
2. Does it affect the version we run? → If no, close.
3. Is there a patch or mitigation? → If yes, schedule. If no, document and monitor.
4. Is it being exploited in the wild (EPSS > 0.5 or KEV)? → If yes, escalate.

Step 4: Patch Regularly

The best vulnerability management program is one where you simply keep software up to date:

• Enable automatic updates for OS packages where feasible
• Renovate or Dependabot can automate dependency updates with PRs
• Schedule a monthly "patch day" to review and apply accumulated updates
• Container base images should be rebuilt regularly against updated bases

Step 5: Monitor Public Intelligence

Free threat intelligence sources you should follow:

• CISA KEV Catalog, confirmed exploited vulnerabilities
• NVD RSS/API, raw CVE data (noisy but comprehensive)
• Vendor security bulletins, subscribe to announcements for your key technologies
• Security Twitter/Mastodon, early signal for emerging threats (follow researchers, not vendors)

Step 6: Document and Improve

Keep a simple log:

• Vulnerability found (CVE ID, date, source)
• Severity and relevance assessment
• Action taken (patched, mitigated, accepted, N/A)
• Date resolved

This log becomes your security audit trail. When a customer asks "do you do vulnerability management?", you can show them evidence instead of promises.

The Maturity Path

Most teams should aim for Stage 2. It costs nothing and covers the majority of known-vulnerability risk. Stage 3 makes sense when you have customers demanding it or compliance requirements to meet.

The Key Insight

Vulnerability management isn't about tools. It's about knowing what you run, knowing what threatens it, and having a process to respond. The tools are just accelerants. The process is what matters.

Start today. It takes an afternoon to reach Stage 1, and a weekend to reach Stage 2.