In most SMEs, nobody knows how many known holes are open today on the company server, the router and the sales reps' laptops. Not because there are none. Because nobody counted.
Vulnerability management sounds like a corporate slide heading. In practice it is a very simple thing: you regularly check what you have, you ask a public database which of those things have known holes, and you patch them in order of how badly they hurt. Three steps. In a 25-person company they take roughly two hours a week. On a good month — less.
At one of our customers — a 25-person metal manufacturing SME in Lower Silesia — the first scan surfaced 847 vulnerabilities, 23 of them flagged as critical. A file server running Windows Server 2016 with six months of missed patches, a network printer with 2019 firmware exposed to the internet because "someone had to print from home once", a MikroTik router with a three-year-old CVE, 11 workstations with an outdated Firefox. None of this was suspicious — nobody had just asked. Six months of systematic work later they had 180 vulnerabilities total, zero critical, and about two hours a week of work.
Nothing bad happened during those six months. That is exactly the point — the kind of work you never notice is the kind that keeps you from showing up in a vendor's incident response case study.
Step 1 — Count what you have
You cannot patch something you don't know exists. So the first step — before you fire up any scanner — is to make a list of everything in your company that has an IP address. Computers, servers, printers, cameras, door controllers, the TV in the meeting room, UPS devices with a network interface, the WiFi-connected cash register.
You don't need a CMDB. One spreadsheet in Excel or a Notion table is enough. For each device you record: name, IP, OS/firmware, who the "owner" is (that is: who to call if you turn it off), when it was last updated. It's the same list that serves hardware inventory and budget planning — so you won't do it twice if you do it once properly.
For workstations alone, a report from Microsoft 365 Business Premium or from Intune is enough — if you already have it. For servers and network gear — one hour with a laptop walking the office and the warehouse. At the metal manufacturer above, that walk uncovered four devices nobody remembered: an old camera left over from a former warehouse manager, a reception printer forgotten after a renovation, and two old laptops in a drawer whose WiFi was still trying to join the company network.
Step 2 — Ask what is actually broken
With the device list in hand, you run a vulnerability scanner against it. You don't need a Qualys license at 12k EUR a year. For a 10-50 person company one of the free or cheap tools is enough:
- Nessus Essentials — free for up to 16 IPs. For a single office that's plenty.
- OpenVAS / Greenbone Community — open-source, needs a bit more setup, no IP limit.
- Qualys Community Edition — a limited free version of their platform.
The first scan runs from inside the network — because most vulnerabilities will sit on devices that are invisible from outside anyway. Then, on a second pass, you scan everything the company exposes to the internet (website, VPN, OWA, router admin panel) — usually a handful of IPs.
The first report is terrifying. Hundreds of entries, each one tagged green, yellow or red, each with a CVE link. That is normal. Most of it is accumulated neglect, not proof that someone is about to breach you. Don't panic. Move to the next step.
Step 3 — Prioritisation, or what to patch first
Your first scan will return 300-1500 entries. You cannot patch all of them in a week, and trying would do more harm than good (you'd be surprised what happens when someone panics 40 patches into a production server in one evening). Prioritisation is the whole game.
Three filters, in order:
- Is anyone actually using this exploit? Check whether the CVE is on the CISA KEV list (Known Exploited Vulnerabilities). If it is — patch this week. The rest can wait. KEV holds roughly 1,200 entries today; your first scan usually hits 5-15 of them. That is your first week's work.
- Is this device even exposed? A CVSS 9.8 on a printer behind NAT is less urgent than a CVSS 7.5 on a router with a public IP. Weigh exposure, not just the CVSS score.
- Does a patch exist and will it break anything? If the patch needs a production ERP restart, you plan a window. If it is just a printer firmware — do it at lunch.
The result at the metal manufacturer: out of 847 entries they got a realistic list — 12 things for the first week, 40 for the first month, the rest spread across the quarter. The "rest" was mostly things like "a Python library version from 2021, unused" that could be closed together on the next OS upgrade.
The routine that holds it together
The first scan is the easy part. The hard part — not sliding back to square one in six months. You need four things, each simple:
- A scan once a month, on the same Monday. Not "when we have time". Written into the calendar, reminder set, 15 minutes to kick it off.
- A review of new entries the same week. 1-2 hours with the person who does the patching. What goes in now, what can wait.
- An alert when something lands on KEV that matches your hardware. Most scanners can do this. If not — a CISA KEV RSS subscription and half an hour on the calendar every week.
- A simple log: what, when, who patched it. One column in the same spreadsheet as the inventory. You will need it when the cyber insurer asks "how do you manage vulnerabilities", or when someone tries to blame you after an incident.
That is it. No SIEM, no SOC, no CISO. A spreadsheet, a scanner and two hours a week.
What not to do
A few traps we've seen companies fall into — usually right after reading an article like this one:
- Don't buy a tool before you've run the first scan with a free one. Qualys/Rapid7 at 8k EUR a year makes sense only once you know what Essentials/OpenVAS can't do. For 90% of 10-50 person companies, they can't do nothing that would bother you.
- Don't patch everything at once. 40 patches in one Saturday is a recipe for a weekend with an outage you cannot roll back fast. Spread it out. Start with what is actually being exploited.
- Don't run this as a project without an owner. "Someone needs to do this" with nobody whose annual objectives list it means it won't be done. You need a person who owns "number of critical vulnerabilities today" and can be asked at any moment.
- Don't pretend the pentester will save you. An annual penetration test is a snapshot, not a process. If between tests you have no patching routine, the next test will tell you the same story as the last one.
If you want to run the first scan in your company but you're not sure which device to start with — half an hour on a call is enough to put together a concrete first-month plan. Whether or not it ends in working together.
Most attacks don't use unknown 0-days. They use holes that have been publicly known for months — and that nobody patched because nobody knew they were there.