In vulnerability management, what is typically the next step after asset discovery and vulnerability scanning?

• A. Risk scoring
• B. Patching
• C. Hiding vulnerabilities
• D. Decommissioning assets

Answer: (A)

Translating scan results into a prioritized remediation plan by scoring risk is what comes next after asset discovery and vulnerability scans. The idea is to convert each vulnerability into a risk estimate that weighs its severity, whether the affected asset is critical, and how exposed it is to attackers. This prioritization guides where to focus patching and mitigation efforts, because there are often more findings than resources to fix them all at once. Patching is the actual remediation action that follows once high-risk items are identified, but it's not chosen in a vacuum—the work is prioritized first. Hiding vulnerabilities or decommissioning assets are not typical next steps in a standard vulnerability management workflow; hiding would leave real risks unaddressed, and decommissioning is only appropriate for assets that are no longer needed or viable.