Building a scalable vulnerability management program on AWS

In October 2023, I co-authored a guide for Building a scalable vulnerability management program on AWS. This guide includes how you can build a structured vulnerability management program, operationalize tooling, and scale your processes to handle a large number of findings from diverse sources. This guide can help you and your organization with the following:

• Develop policies to streamline vulnerability management and maintain accountability.
• Establish mechanisms to extend the responsibility of security to your application teams.
• Configure relevant AWS services according to best practices for scalable vulnerability management.
• Identify patterns for routing security findings to support a shared responsibility model.
• Establish mechanisms to report on and iterate on your vulnerability management program.
• Improve security finding visibility and help improve overall security posture.