Skip to content
Made in the UK

How do MSPs run vulnerability management?

By , CEO, CybaVerse. Last reviewed

MSPs run vulnerability management as a continuous cycle for every client: scan all devices, prioritise findings by severity, CVSS score, known exploitation and the number of affected assets, fix or formally accept each one, then rescan to confirm it has closed. Monthly reports show clients the trend, not just the count.

This guide is part of the CybaVerse Knowledge Hub.

What does good vulnerability management look like?

Good vulnerability management means you always know what is exposed, what to fix first and whether last week's fixes worked. The NCSC describes it as a continuous process that covers identification, triage, remediation and verification, owned by someone with authority to make changes.

For an MSP, the extra challenge is scale. The same process has to run across dozens of client tenancies, each with different devices, owners and change windows. That only works when findings, priorities and status live in one place rather than in separate scanner exports.

How should MSPs prioritise vulnerabilities?

Prioritise by combining severity with real-world context. Start with critical and high findings, then use the CVSS base score to separate similar items. Raise anything on the CISA Known Exploited Vulnerabilities catalogue, and favour fixes that clear a vulnerability from many devices at once. That order reduces the most risk per engineer hour.

SignalWhat it tells youSource
SeverityHow dangerous the issue isVendor and scanner
CVSS base scoreTechnical severity out of 10FIRST CVSS
Known exploitedAttackers are using it nowCISA KEV catalogue
Exploit likelihoodProbability of exploitationFIRST EPSS
Affected assetsHow much one fix achievesYour inventory

The Cyber Essentials requirements add a hard rule: critical or high-risk fixes, including anything with a CVSS v3 base score of 7 or above, must be applied within 14 days of release.

How do you run the cycle across many clients?

Run the same five-stage cycle for every client tenancy, with the same severity rules and the same evidence. Consistency is what lets one MSP team cover many clients without missing deadlines. The steps below follow NCSC vulnerability management guidance and suit most MSP estates.

  1. Step 1: Cover every device

    Make sure each device has the scanning agent, and find the ones that do not.

  2. Step 2: Triage new findings daily

    Review new critical and high findings each day for every client.

  3. Step 3: Assign an owner and a date

    Every finding gets an owner and a due date based on severity.

  4. Step 4: Fix or formally accept

    Apply the fix, or record a false positive or accepted risk with a reason.

  5. Step 5: Verify and report

    Rescan to confirm closure, then report trends to the client each month.

Which questions does this cluster answer?

The pages below answer the vulnerability management questions MSPs ask most, from scan frequency to false positives and board reporting. Each page gives a direct answer, steps and sources. Use the links to go straight to the question you need.

  • How do you prioritise vulnerabilities: severity, CVSS or affected assets?
  • How often should an MSP scan client devices for vulnerabilities?
  • How do MSPs run vulnerability management across many client tenants?
  • How do you handle vulnerability false positives properly?
  • Why do fixed vulnerabilities still show as open after patching?
  • How do MSPs report vulnerability reduction to clients and boards?

How does CybaOps help with vulnerability management?

CybaOps gives MSPs one place to see vulnerabilities across every client, tied to the assets they affect. Scanning runs continuously, so findings are current when the team sits down to prioritise, and the same view works whether an MSP looks after five client tenants or many more across its base.

  • CybaVM gives continuous internal and external vulnerability scanning, prioritised in one place in CybaOps.
  • Vulnerability scanning in CybaOps is powered by Qualys.
  • Internal scans run several times a day and external scans run daily.
  • CybaOps ties vulnerabilities to the assets they affect, so teams fix what matters first.
  • CybaOps handles large vulnerability volumes across many customer tenants.
  • Vulnerability data can be exported from CybaOps reports.
  • The CybaOps Remediation Engine is live today: it can fix security issues automatically, so gaps get closed rather than just reported.

Vulnerability management

How MSPs run vulnerability management

MSPs run vulnerability management as a continuous cycle for every client: scan all devices, prioritise findings by severity, CVSS score, known exploitation and the number of affected assets, fix or formally accept each one, then rescan to confirm it has closed.

01 Scanning

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Vulnerability management

02 The 5-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • Vulnerability management in
  • CybaVM
  • CybaRemediate

What else do MSPs ask about vulnerability management?

These are the follow-up questions we hear most from MSPs building a vulnerability management service.

Is a quarterly scan enough?

Rarely. New vulnerabilities are published every day, and the Cyber Essentials 14-day window is far shorter than a quarter. Continuous agent-based scanning finds issues in time to fix them inside the window.

What is the difference between a vulnerability scan and a penetration test?

A vulnerability scan checks devices automatically for known weaknesses. A penetration test is a manual, time-boxed exercise in which a tester tries to exploit weaknesses. Scanning should run continuously; testing complements it periodically.

Should we fix every vulnerability?

No. Fix the ones that carry real risk first, within the deadlines your standards set. Record a reason for anything you accept or mark as a false positive, so the decision can be reviewed later.

What should you do next?

See how the pieces fit together on the CybaOps platform page. MSPs can read about the CybaVerse partner model for MSPs.

See CybaOps Vulnerability Management across several client tenancies.

Book a CybaOps demo