Vulnerability Register
A vulnerability register is the record of technical weaknesses identified on specific assets, holding one entry per weakness per asset and moving on a daily cycle as findings are detected, triaged, remediated and verified.
What It Holds
One entry per technical weakness per asset. A missing patch on forty servers produces forty entries rather than one, because remediation happens per asset and each has its own state.
Entries carry the weakness, frequently identified by a CVE reference, the affected asset, a severity score, a detection date, an owner and a current status. Volume runs to thousands or more in any sizable estate.
Who Owns It and How It Moves
Security operations owns it, scanning feeds it, and it moves on a daily cycle as findings open and close. The lifecycle runs from detection through triage and remediation to verified closure, with risk acceptance as an alternative outcome at the triage stage.
That daily rhythm is the clearest practical difference from a security risk register, which moves quarterly because treatment decisions rather than remediation tasks are what change.
Why Closure Counts Mislead
A count of findings closed measures activity rather than exposure reduction. Closing the easiest findings improves the count while leaving control effectiveness broadly where it was, so coverage achieved is the more useful measure.
Coverage is also the quantity that connects the two registers, since a finding carries no financial value on its own and what it changes is the coverage of a control across a population.
The Acceptance Problem
A finding marked accepted leaves the remediation queue, which is a legitimate operational decision. The scenario in the security risk register that assumed the control was being maintained is rarely notified, so the register continues to carry a likelihood resting on an assumption the organization has quietly abandoned.
Any process connecting the two registers should propagate acceptance upward, not only closures.
Related Terms
Turn Cyber Risk Into Financial Exposure the Board Can Act On
Security leaders are being asked to defend budgets, prioritize controls, and report cyber risk in the same terms as every other enterprise risk. Kovrr's CRQ Platform models loss scenarios, benchmarks control performance, and gives the C-suite a defensible view of where cyber sits on the balance sheet.
