Vulnerability Management

The Vulnerability Management category covers products that scan servers, endpoints, network devices, cloud workloads and applications for known weaknesses, such as missing patches, outdated software and insecure settings, and then manage what they find. Typical entries assign each finding to an owner, open tickets, track deadlines and rescan to confirm that the fix worked. Agent-based and network scanning products both belong here.

Products whose main strength is ranking vulnerabilities by how likely they are to be exploited fit Risk-Based Vulnerability Management, and products that install the fixes fit Patch and Configuration Management. Vulnerability management where AI does the core work fits AI-Powered Vulnerability Management, and testing application code and running applications fits Application Security. Every vulnerability management product is also eligible for Cyber Exposure Management, the broad exposure category, where it is judged next to platforms that cover more kinds of exposure.

Related categories to enter

Each category is judged separately, so you can enter a product in every category that matches what it does, with a separate nomination for each. Tailor each nomination to that category's focus. Entering several related categories gives the product more than one chance to be recognized.

Risk-Based Vulnerability Management — for ranking vulnerabilities by real-world risk
Patch and Configuration Management — for deploying the patches and configuration fixes
AI-Powered Vulnerability Management — for AI that finds, ranks or fixes vulnerabilities
Attack Surface Management or Cyber Asset Attack Surface Management (CAASM) — for discovering the assets that need scanning
Cyber Exposure Management — for an added entry among broad exposure platforms
Vulnerability Management for Healthcare — for scanning hospital networks and medical devices
Vulnerability Management Professional of the Year — for the person who runs the vulnerability program

How entries are judged

An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against organizations of similar size and region, so a mid-sized firm is not ranked against a global enterprise. Your entry package, any sponsorship and public votes do not affect the jury's scores.

Strong entries in this category show:

Leadership — the scale of what the product scans and tracks: assets covered, findings managed each month, and customers that run their vulnerability program on it.
Innovation — a vulnerability problem solved in a new way, such as scanning without agents or stored credentials, accurate results with few false positives, or tracking a finding from discovery to verified fix without manual steps.
Impact — results for customers: time to fix critical vulnerabilities, backlog reduced, assets scanned that were never covered before. Give before-and-after figures.

The jury awards Gold, Silver or Bronze, or a Finalist badge, and results are published on this site and announced to the 600,000+ member Cybersecurity Insiders community. Every approved nomination also enters the separate Community Choice award, decided by public votes.

How to enter

A vendor can enter its own product or service, and a PR agency can enter it on a client's behalf. The nomination form has a confidential field for detail that is shared with the judges and not published, such as customer names, deployment figures or roadmap. Deadlines, pricing and entry steps are on the How it Works page.