HACKING PROJECT · cloud · Beginner
Vulnerability Management
Enable a student to operate a risk-based vulnerability management lifecycle that prioritizes remediation by real-world exploitability, not raw CVSS alone.
Enterprises struggle to continuously discover, prioritize, and remediate vulnerabilities across sprawling asset inventories, leaving exploitable weaknesses open for weeks or months. Raw scanner output produces thousands of findings with little business context, causing alert fatigue and mis-prioritized patching. Without a structured vulnerability management lifecycle, remediation is reactive rather than risk-driven.
**What you'll build**
Build a vulnerability management pipeline that automates asset discovery, runs authenticated/unauthenticated scans (OpenVAS/Nessus/Trivy), normalizes findings, and enriches them with CVSS, EPSS, and CISA KEV data to produce risk-based prioritization. Track findings through a remediation workflow with SLAs and generate stakeholder dashboards. The system operationalizes the full identify-assess-prioritize-remediate-verify loop.
**Objective** — Enable a student to operate a risk-based vulnerability management lifecycle that prioritizes remediation by real-world exploitability, not raw CVSS alone.
**Expected outcome** — A vulnerability management dashboard/pipeline that ingests scan results, enriches with EPSS/KEV, ranks by risk, and outputs a prioritized remediation report with SLA tracking.
**Difficulty** — Beginner — accessible with scanner tooling and scripting, though enrichment and prioritization logic reach Intermediate.
**Primary category** — Vulnerability Management / GRC; Secondary = SOC, DevSecOps (CI/CD scanning), Cloud Security
**Security domains** — Primary = Blue Team; Secondary = GRC, Cloud Security, DevSecOps, Threat Intelligence
**Technical focus** — Asset discovery/inventory, authenticated scanning, CVSS/EPSS scoring, CISA KEV enrichment, risk-based prioritization, patch management workflow, SLA tracking, compliance reporting, SBOM/container scanning
**Core technologies** — Languages: Python, SQL; Frameworks/Libraries: pandas, REST API clients, Flask/Streamlit for dashboard; Security Tools: OpenVAS/Greenbone, Nessus Essentials, Trivy, Nmap, Nuclei; Cloud/Infra: Docker, optional AWS Inspector; AI/Data: EPSS/KEV feeds, optional ML risk model; Databases: PostgreSQL/SQLite
**Where it's valued** — Every regulated sector — finance, healthcare, retail, SaaS, government, manufacturing, MSSPs
**Careers it builds toward** — Vulnerability Management Analyst, SOC Analyst, GRC Analyst, Security Engineer, DevSecOps Engineer
**Framework alignment**
• MITRE ATT&CK: Not a technique-mapped attack project; relevant to defensive coverage of Exploit Public-Facing Application (T1190) and Exploitation of Remote Services (T1210) surfaces
• NIST CSF 2.0: Identify (Risk Assessment, Asset Management), Protect, Govern (risk prioritization)
• OWASP: A06:2021 Vulnerable and Outdated Components; API/Web Top 10 as scan targets
• CIS Controls v8: 7 (Continuous Vulnerability Management), 1 (Enterprise Asset Inventory), 2 (Software Inventory), 4 (Secure Configuration)
**Innovation** — Improved Existing Solution — commercial VM platforms exist, but a risk-based EPSS+KEV prioritization engine with SLA workflow is a strong, employable build. Scores: Innovation 5/10, Startup 6/10, Enterprise-Readiness 7/10, Patent = No.