Current version: v2.0.0
Release date: 2026-01-29
Canonical documentation: https://zenzizensec.com/vmmm
Free assessment tool: https://zenzizensec.com/vmmm
Maintained by: ZenzizenSec Inc. | Jonathan Risto
The Vulnerability Management Maturity Model (VMMM) is a reference-based maturity model designed to help organizations assess, understand, and improve their vulnerability management capabilities.
VMMM provides a structured way to evaluate VM maturity across lifecycle phases, domains, and categories, enabling consistent assessment, prioritization, and improvement planning across organizations and industries.
VMMM is intended to be:
- A shared reference model for vulnerability management maturity
- A neutral assessment framework usable across tools and vendors
- A foundation for maturity evaluation, gap analysis, and roadmap planning
- A common language for security, risk, and leadership discussions
The model is designed for use by enterprises, consultants, educators, researchers, and vendors.
This repository is organized to separate canonical model content, supporting materials, and reference mappings.
-
/canon
Authoritative, versioned VMMM v2 documents, including the canonical model, companion guide, and examples. -
/capability-reference
Framework alignment and mapping artifacts (e.g., NIST, ISO, CIS), intended to support adoption and interpretation. -
/assessments
Assessment methodology, scoring philosophy, and related materials. -
Root files (
README.md,LICENSE.md,VERSION, etc.)
Governance, licensing, and release metadata.
VMMM is:
- A maturity model for vulnerability management capabilities
- Tool-agnostic and vendor-neutral
- Suitable for internal assessments and external advisory use
- Designed for long-term stability and reference
VMMM is not:
- A product or platform
- A prescriptive implementation guide
- A certification or compliance standard
- A replacement for VM strategy or tooling
This repository contains the canonical VMMM v2.0.0 artifacts:
-
VM_Maturity_Model_v2.0.0.xlsx
The core Vulnerability Management Maturity Model assessment and scoring worksheet -
VMMM_Companion_Guide_v2.0.0.pdf
Detailed explanations of domains, categories, and maturity intent -
VMMM_Examples_and_Use_Cases_v2.0.0.pdf
Practical examples and applied use cases
VMMM may be used to:
- Perform internal or external vulnerability management maturity assessments
- Identify capability gaps and improvement priorities
- Support VM program design and roadmap planning
- Align stakeholders on VM scope and maturity expectations
- Communicate VM maturity to leadership and governance bodies
VMMM is designed to be adaptable to different organizational sizes, industries, and risk profiles.
VMMM organizes vulnerability management capabilities across five lifecycle phases:
Establishes the foundation for effective vulnerability management through governance, policy, roles, and strategic alignment.
Domains include:
- Context
- Crisis Response & Zero-Day Readiness
- Policy & Standards
- Program Governance
- Risk Appetite & Tolerance Definitions
- Security Ecosystem Integration
- VM Roles & Responsibilities
- Crisis Communication Readiness
- Data Quality & Source of Truth
- Third-Party VM Readiness
Discovers and catalogs assets, vulnerabilities, and exposures across all environments.
Domains include:
- Ephemeral & Short-Lived Asset Discovery
- External Vulnerability Intelligence Ingestion
- Manual Discovery & Analyst Testing
- Shadow IT & Rogue Asset Detection
- Third-Party Asset Discovery
- Asset Inventory & Classification
- Automated Vulnerability & Exposure Scanning
- Application & Service Discovery
Evaluates vulnerabilities using risk-based prioritization, business impact, and threat intelligence.
Domains include:
- Business Impact Modeling
- Exploitability Assessment
- False Positive & Suppression Validation
- Risk-Based Prioritization
- Third-Party Risk Identification
- Root Cause Analysis
- Threat Intelligence Correlation & Exploit Analysis
- Vulnerability Aging & Exposure Tracking
- Vulnerability Clustering & Campaigns
Ensures vulnerability risk information reaches the right stakeholders with appropriate context and urgency.
Domains include:
- Alerting & Operational Notification
- Exception & Risk Acceptance Communication
- Governance & Escalation Reporting
- Metrics & Performance Reporting
- Stakeholder Engagement & Risk Framing
- Vulnerability Disclosure Management
Executes remediation, applies compensating controls, and validates that vulnerabilities are resolved.
Domains include:
- Change Management Integration
- Compensating Controls
- Configuration Management
- Patch Management
- Remediation Orchestration & Automation
- Remediation Validation & Closure
- Risk Acceptance Governance
VMMM domains are classified to help organizations prioritize improvement efforts:
- Foundational Domains: Core capabilities required for a functioning VM program
- Enhanced Domains: Capabilities that expand and scale the program
- Strategic Domains: Advanced capabilities that embed VM into broader business operations
VMMM is released under a reference-friendly license that allows free use, assessment, consulting, training, and academic reference.
- See LICENSE.md for usage terms
- See TRADEMARK.md for trademark guidance
Use of VMMM does not imply endorsement or certification.
VMMM follows semantic-style versioning.
- v2.0.0 is the current canonical release
- Future versions will introduce only meaningful structural or intent changes
- Editorial or wording refinements may occur without version increments
A summary of changes is maintained in CHANGELOG.md.
When referencing VMMM, please use:
Vulnerability Management Maturity Model (VMMM) v2.0.0, ZenzizenSec Inc., 2026.
VMMM is a companion model to the Continuous Threat Exposure Management Maturity Model (CTEMMM). While VMMM focuses on traditional vulnerability management capabilities, CTEMMM addresses the broader discipline of continuous threat exposure management including attack surface management, validation, and mobilization.
Organizations may use both models together to assess comprehensive exposure management capabilities.
VMMM is stewarded by ZenzizenSec Inc.
Authored by Jonathan Risto.
The model is intended to remain open, stable, and broadly usable while preserving its integrity and identity.
- Website: https://zenzizensec.com/vmmm
- Free Assessment: https://zenzizensec.com/vmmm
For licensing or trademark inquiries:
[email protected]