Resources · Security · 7 min read

Find the CVE exposure hiding in your software inventory

Most organisations patch the software they know about. The risk is the software they don't — the forgotten installs, the old versions, the tools one team rolled out and nobody tracked. You can't patch what you can't see, and a vulnerability is only as managed as your inventory is complete.

Why inventory is a security problem

A CVE — a publicly catalogued vulnerability — only matters to you if the affected software is actually running somewhere in your estate. The entire question of “are we exposed?” reduces to two facts: which vulnerabilities exist, and what is actually installed where. Security teams usually have the first. The second — a complete, current software inventory mapped to devices — is where most programmes fall down.

• Shadow installs. Software deployed outside the standard process never makes it onto the radar.
• Version blindness. “We have Acrobat” isn’t enough; the vulnerability is in a specific version on specific machines.
• Stale inventory. An inventory that’s weeks out of date can’t answer “are we exposed right now?”.

From CVE to “which machines, whose”

Useful vulnerability management answers a chain of questions, not just the first one:

1. Which known vulnerabilities affect software we run? — match CVEs to your installed applications and versions.
2. Which devices are affected? — the blast radius, by machine.
3. Who owns them? — so remediation goes to a person, not a queue.
4. What’s the priority? — severity combined with exposure and how many devices are hit.

Each step needs your asset and software inventory to be accurate. This is the quiet reason a trustworthy CMDB is a security asset, not just an operational one.

Prioritise by exposure, not just severity

A critical CVE on two isolated machines may matter less than a high-severity one on twelve hundred. Rank remediation by severity and reach — how many devices, how exposed, who uses them. That’s how you spend limited patching effort where it actually reduces risk.

Close the loop

Finding exposure is half the job. The other half is making sure it gets fixed: turn each finding into an accountable task assigned to the owner, track it to closure, and re-check after patching. A finding that sits in a dashboard nobody actions is not a reduction in risk.

Your vulnerability posture is downstream of your inventory. Get the “what’s installed where” right, and CVE exposure becomes a query you can answer on demand — not a quarterly scramble.

How ClearVisibility helps

Because ClearVisibility already reconciles the applications detected on every device, CVE exposure isn’t a separate scanning project — it’s a question asked against data you already hold. It ties known vulnerabilities to your installed software, shows the affected devices and their owners, surfaces Microsoft Secure Score and Defender signals alongside, and routes remediation through its task monitor so exposure gets closed, not just flagged.