SOC106 · Vulnerability Management and Patching

Categories: Cybersecurity
Wishlist Share

About Course

Run a risk-based vulnerability management program: know your assets, scan them safely, prioritize with CVSS, EPSS and the CISA KEV catalog, and patch on a schedule you can prove.

Advance · 8 hours · 4 lessons, a lab, an assessed assignment and a portfolio piece

Who it is for

IT administrators, analysts and small-business tech owners responsible for keeping systems patched and secure.

Prerequisites

Complete SOC102 and SOC103, or be comfortable administering Windows or Linux systems.

What you will be able to do

  • Build and maintain an asset inventory with owners and criticality
  • Scan your own systems and container images with free tools and interpret the findings
  • Prioritize vulnerabilities by combining CVSS severity, EPSS likelihood, KEV status and asset exposure
  • Design a patching policy with service-level targets, exceptions and verification

Lessons

  • Lesson 1 · Assets, exposure and the vulnerability lifecycle
  • Lesson 2 · Scanning and risk-based prioritization
  • Lesson 3 · Patching policy, exceptions and verification
  • Lesson 4 · Lab and assignment

Lab: Scan, prioritize and plan remediation

You scan an intentionally outdated container image and your own Ubuntu lab system with Trivy, export the results, and enrich each CVE with its EPSS score and KEV status. You then rank the findings with a simple risk formula and write a remediation plan with owners and due dates.

Free tools: Trivy (free, open source) with Docker Desktop, an Ubuntu virtual machine or WSL2, the CISA KEV catalog CSV and the FIRST EPSS data, and a spreadsheet

Assessed assignment

Write a vulnerability management policy and a first-cycle remediation plan for a 40-person e-commerce company with a public web store, a payment integration and office laptops. Define scope, scan frequency, prioritization rules, patch service-level targets and the exception process. Apply the rules to your lab scan results and present the top ten items with justification. Include how you will verify that patches were applied.

Criterion Weight What excellent work looks like
Policy completeness 25% Scope, frequency, roles, targets and exceptions are defined clearly and fit the business.
Prioritization logic 30% Rules combine severity, exploitation likelihood, KEV status and exposure in a consistent, explained way.
Application to real findings 25% The top ten list follows the rules, is traceable to scan output and has owners and dates.
Verification and reporting 20% Re-scan and reporting steps prove remediation and show trends to leadership.

Portfolio piece

A vulnerability management policy with a prioritized remediation plan built from real scan data.

Self-paced, 12-month access. Questions are answered in writing through the student panel. A completion record is issued when you finish the course.

Next step

Continue with SOC107 · Incident Handling and Digital Forensics Basics · 8 hours · $56.00

Continue to the next course

Prefer the whole program? Program in Security Operations & Threat Defense · $378.00 (10% less than buying the courses separately)

Show More

What Will You Learn?

  • Build and maintain an asset inventory with owners and criticality
  • Scan your own systems and container images with free tools and interpret the findings
  • Prioritize vulnerabilities by combining CVSS severity, EPSS likelihood, KEV status and asset exposure
  • Design a patching policy with service-level targets, exceptions and verification

Course Content

SOC106 · Vulnerability Management and Patching (8 h)
Run a risk-based vulnerability management program: know your assets, scan them safely, prioritize with CVSS, EPSS and the CISA KEV catalog, and patch on a schedule you can prove.

  • Lesson 1 · Assets, exposure and the vulnerability lifecycle
  • Lesson 2 · Scanning and risk-based prioritization
  • Lesson 3 · Patching policy, exceptions and verification
  • Lesson 4 · Lab and assignment
  • SOC106 Assessment · Vulnerability Management and Patching
Scroll to Top