Known vulnerabilities, not exotic zero-days, are how most breaches start: a flaw in a popular product, published weeks earlier, left unpatched. vulneraibility.com tells your leadership team, in plain language, whether that is happening to you and what it takes to fix it.
Critical, High, Elevated or Low, defined by explicit rules: for example, Critical means a vulnerability known to be exploited in the wild affects a product you run.
Five priorities at most, each with why it matters and what to do, instead of a list of identifiers.
Fixes are grouped by upgrade: "three upgrades close ten of the thirteen vulnerabilities that affect us" is a sentence a budget holder can act on.
Accepted risks are listed with who accepted them, when and why, so oversight is a review of decisions, not a reconstruction of events.
One rating with a written rule behind it.
The handful of exposures that need a decision or money.
The upgrades that close most of the exposure.
Risks accepted on purpose, with the reasons.
Is the programme keeping up? Coverage and ageing, measured.
Quarterly, with the one-page summary and its trend, plus an immediate escalation when a known-exploited vulnerability affects a critical system. Monthly reviews belong to the CISO and the risk committee.
It means no open vulnerability that names a product you declared currently needs remediation. It depends on the inventory being complete and covers known vulnerabilities, not every kind of cyber risk.
Nobody, manually. It is generated from the same data the security and engineering teams work in, so the numbers on the page match what they see every day.