What Is Continuous Vulnerability Management?
2026-07-29 · 4 min read
A vulnerability scan tells you what's wrong with your application on the day it ran. Vulnerability management is what happens after — tracking each finding, assigning ownership, and confirming a fix actually worked.
Why a one-time scan isn't enough
Applications change constantly. New endpoints ship, dependencies update, configurations drift. A scan report from three months ago tells you nothing about what's true today. Without continuous scanning, the gap between "when we last checked" and "right now" just keeps growing.
The lifecycle that actually matters
A finding should move through a real lifecycle: New → Open → Acknowledged → In Progress → Resolved → Verified, with explicit states for False Positive and Accepted Risk. Two things make this work in practice:
- Deduplication. The same underlying issue found on repeated scans should show up once, not as a new item every time.
- Verification. A finding disappearing from a scan isn't proof it's fixed — it could mean the scanner couldn't reach that part of the app this time. Resolution should require repeated clean scans, and a dedicated confirmation rescan before a finding is marked Verified.
How this fits into Sentinel
Sentinel runs continuous, authorised vulnerability scanning against your web applications, with every finding tracked through this full lifecycle — not a PDF that gets read once and forgotten.