About the Risk-Based Vulnerability Management category
What belongs in this category
The Risk-Based Vulnerability Management category covers products that take findings from scanners and other sources and decide which ones to fix first. Typical entries weigh evidence of exploitation in the wild, threat intelligence, whether a system can be reached from the internet, what the asset does for the business and which controls already protect it, then give each team a short, ranked list with the reasons behind it.
Scanning and tracking vulnerabilities fits Vulnerability Management, and a product that scans as well as ranks can enter that category too. Ranking that covers misconfigurations, identity weaknesses and other exposures as well as vulnerabilities fits Exposure Assessment Platform. Because ranking is one part of exposure management, a risk-based product can always add an entry in Cyber Exposure Management, the broad category for that area.
Related categories to enter
Each category is judged separately, so you can enter a product in every category that matches what it does, with a separate nomination for each. Tailor each nomination to that category's focus. Entering several related categories gives the product more than one chance to be recognized.
How entries are judged
An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against organizations of similar size and region, so a mid-sized firm is not ranked against a global enterprise. Your entry package, any sponsorship and public votes do not affect the jury's scores.
Strong entries in this category show:
- Leadership — the volume the product ranks: findings and sources brought in, assets and business units covered, and customers that set fix priorities with it.
- Innovation — a prioritization problem solved in a new way, such as risk scores a team can explain to system owners, ranking that reflects compensating controls, or priorities that change as soon as attackers start using a flaw.
- Impact — results for customers: fewer findings marked urgent, actively exploited vulnerabilities fixed first, remediation effort saved. Give figures from customers.
The jury awards Gold, Silver or Bronze, or a Finalist badge, and results are published on this site and announced to the 600,000+ member Cybersecurity Insiders community. Every approved nomination also enters the separate Community Choice award, decided by public votes.
How to enter
A vendor can enter its own product or service, and a PR agency can enter it on a client's behalf. The nomination form has a confidential field for detail that is shared with the judges and not published, such as customer names, deployment figures or roadmap. Deadlines, pricing and entry steps are on the How it Works page.
