Vulnerability Management at Scale with Open Source Tools

BLUF

Open source vulnerability management can match enterprise capabilities at zero licensing cost. This guide covers the stack I built in my homelab across 200+ assets, targeting MTTD under 24 hours and MTTR under 7 days for critical findings.

What you’ll learn:

• Complete toolchain (discovery, scanning, orchestration, visualization)
• Scanner integration (OpenVAS, Trivy, OWASP ZAP, Nuclei)
• Risk-based prioritization (CVSS, EPSS, CISA KEV)
• Automation workflows (Apache Airflow DAGs, remediation tracking)
• Operational metrics (MTTD, MTTR, coverage, SLA compliance)

Architecture components:

• 20 integrated tools (Nmap, OpenVAS, Trivy, Grype, Wazuh)
• Automated scanning across VMs, containers, bare metal, cloud
• PostgreSQL + Elasticsearch backend (10,000+ vulnerability records)
• Grafana dashboards with real-time status
• Apache Airflow orchestration

Why this matters: Enterprise VM platforms scale into six figures for large fleets, but at 200 assets a commercial scanner runs about $5K a year. The case for open source at this size is control and integration, not licence cost. Open source alternatives, when properly integrated, deliver equivalent capabilities.

many bugs, one that matters

Vulnerability Management Architecture

Modern vulnerability management requires defense-in-depth strategies. Learn more about implementing zero-trust architecture to complement vulnerability scanning with access controls.

NVD DatabaseCVE/MITREGitHub AdvisoryOSV Database

Data CollectorCVE ParserData EnricherRisk Scorer

PostgreSQLRedis CacheML Analysis

REST APIDashboardAlert System

The architecture combines multiple open source tools into a cohesive system. Key insight: integration matters more than individual tool selection.

Tool Stack

Discovery:

• Nmap (detailed host/service enumeration)
• Masscan (high-speed network sweeps; the README claims 10M packets/sec, ~1.6M is realistic on stock Linux)

Vulnerability scanning:

• OpenVAS/GVM[8] (~138,000 vulnerability tests)
• Nuclei (custom templates, web scanning)
• Wazuh[11] (agent-based endpoint monitoring)

Container scanning:

• Trivy[6] (24 OS distributions, 13 language ecosystems, SBOM generation)
• Grype[7] (fast scanning, GitHub Advisories)
• Clair (registry integration)

Web application:

• ZAP (Zed Attack Proxy) (active scanning, OWASP Top 10[12])
• Nikto (web server misconfigurations)
• SQLMap (SQL injection detection)

Orchestration:

• Apache Airflow[10] (workflow DAGs)
• n8n (lightweight automation)

Data management:

• PostgreSQL (structured vulnerability data)
• Elasticsearch (full-text search, aggregations)

Visualization:

• Grafana (real-time dashboards)
• Kibana (log analysis)

Ticketing:

• GLPI (asset management integration)
• Request Tracker (workflow automation)

Building the Foundation

Asset Discovery and Inventory

Complete asset visibility is the foundation:

Discovery methods:

• Active scanning: Nmap (detailed enumeration), Masscan (~1.6M packets/sec on stock Linux)
• Passive monitoring: Traffic analysis, DHCP logs, DNS queries
• Cloud API: AWS Config, Azure Resource Graph, GCP Asset Inventory
• Agent-based: Wazuh agents for laptops and mobile devices

Asset classification:

• Infrastructure: Servers, VMs, network devices
• Cloud: EC2/VM instances, S3 buckets, Lambda, managed databases
• Containers: Docker, Kubernetes pods (hours-long lifespan)
• IoT/OT: SCADA, building automation, IP cameras

Challenges:

• Shadow IT: Unauthorized SaaS apps, rogue cloud accounts
• Cloud sprawl: Multi-account AWS, orphaned instances
• Ephemeral infrastructure: auto-scaling groups creating and destroying instances between scan windows
• Multi-cloud: Unified inventory without vendor lock-in

Validation:

• CMDB reconciliation: Daily sync, 5-10% drift expected
• Ownership: Auto-tagging by VPC/subnet, AD group, cost center
• Decommission detection: Flag assets offline >30 days

Vulnerability Scanning Orchestration

No single scanner catches everything. Integrate multiple tools:

Scanner selection by asset type:

• Network: OpenVAS/GVM[8] (90K+ tests), authenticated scanning
• Containers: Trivy[6] (24 OS distributions, 13 language ecosystems), Grype[7] (SBOM), Clair (registry)
• Web apps: OWASP ZAP (active), Nikto (misconfigs), Nuclei (custom)
• IaC: Checkov (Terraform/CloudFormation), Terrascan (policy)

Scanning strategies:

• Authentication: credentialed scans surface substantially more than unauthenticated ones — enough that an unauthenticated-only programme is measuring the perimeter, not the fleet
• Frequency: Critical (daily), production (weekly), dev/test (monthly)
• Bandwidth: Rate limit <10% capacity, maintenance windows
• Scan windows: Off-hours (2AM-6AM is a common convention), coordinate with change freeze

False positive management:

• Baseline: 20-40% initial false positives, drops to 5-10% after tuning
• Triage: Auto-filter by CVSS, asset criticality, exploit availability
• Suppression: Document exceptions (WAF-protected, compensating controls)
• Exception tracking: Business owner approval, annual recertification

Orchestration:

• Airflow DAGs: Discovery → scan → normalize → dedupe
• For runtime confinement of containers after scanning, see Docker runtime security hardening with LSMs
• Scheduling: Stagger starts, retry logic for failures
• Aggregation: Normalize SARIF, CycloneDX, Dependency-Check formats
• Deduplication: Merge findings across scanners (single source of truth)

Remediation Tracking and Automation

Structured remediation requires prioritization, SLAs, automation, and tracking:

Prioritization:

• CVSS base score[3] (severity foundation)
• EPSS exploit probability[4] (active exploitation likelihood)
• CISA KEV catalog[2] (known exploited vulnerabilities)
• Asset criticality (business impact multiplier)

SLAs:

• Critical: <7 days
• High: <30 days
• Medium: <90 days
• Low: Next maintenance window

Automation:

• Patch management: Ansible playbooks
• Configuration remediation: Secure defaults, hardening
• Temporary mitigations: WAF rules, network segmentation
• Rollback: Procedures for failed patches

Tracking:

• Auto-ticket creation: GLPI, Request Tracker
• Assignment: Based on asset ownership
• Aging alerts: SLA breach warnings
• Velocity metrics: Remediation throughput
• Exception workflows: Risk acceptance approval

Dashboards and Reporting

Different stakeholders need different views:

Executive KPIs:

• Risk score trending
• MTTD/MTTR by severity
• Coverage percentage
• SLA compliance by team

Security operations:

• Vulnerability breakdown (Critical/High/Medium/Low)
• Scan status (completion, failures, gaps)
• False positive triage queue
• Remediation backlog with aging

Compliance:

• NIST 800-53[5] control coverage
• PCI DSS mapping (quarterly scanning, critical patching)
• Vulnerability age distribution
• Patch compliance by system type

Alerting:

• Critical detection (CVSS ≥9.0, CISA KEV)
• SLA breach warnings (7/30/90 days)
• Scan failures
• New asset discovery

Integration and Automation

Automation is essential for scale:

The shape that works is a scheduled DAG with five stages — asset discovery, scanning, remediation-ticket creation, automated patching where it is safe, and reporting — each depending on the last. Airflow is a reasonable choice for it, with one caveat worth knowing before you copy anything from an older tutorial: the airflow.operators.python_operator and bash_operator import paths were deprecated in Airflow 2 and removed in Airflow 3. On 3.x it is airflow.providers.standard.operators.python.

The scheduler is the least interesting part of this. What matters is that discovery runs before scanning, so you are not scanning an asset list that is a month stale.

Lessons Learned

1. Start with asset management

Discovery is the foundation. Continuous scans, CMDB reconciliation, ownership attribution, and decommission detection prevent ghost assets.

Automation milestones:

• 10 servers: Manual scanning, spreadsheets
• 100 servers: Automated schedules, API ticketing
• 1,000+ servers: Airflow orchestration, auto-remediation, ML prioritization

2. Context over severity

Critical vulnerability on dev server ≠ critical on production domain controller.

Prioritization factors:

• Asset criticality (production > development > test)
• Network exposure (internet-facing > DMZ > internal)
• Compensating controls (WAF, segmentation, EDR)
• Business impact (revenue systems prioritized)

3. Measure what matters

Operational metrics:

• MTTD: <24 hours (critical assets)
• MTTR: <7 days (critical), <30 days (high)
• Coverage: >95% production assets
• False positives: <10% after tuning
• SLA compliance: By severity tier
• Remediation velocity: Vulnerabilities/week trending

These align with SANS Vulnerability Management Maturity Model[13].

4. Integration is essential

Critical integration points:

• CMDB: Authoritative inventory, ownership, criticality
• Ticketing: GLPI/Jira/ServiceNow automation
• CI/CD: Container scanning, IaC policy, build breaks
• SIEM/SOAR: Threat correlation, automated response
• Patch management: Verification, rollback
• Configuration: Ansible Tower/AWX remediation
• Cloud APIs: AWS Security Hub, Azure Security Center, GCP Command Center

Disconnected tools get abandoned.

Conclusion

Open source vulnerability management matches commercial capabilities with proper integration. Start with asset discovery and basic scanning, then add automation, integration, and advanced features incrementally.

For additional security monitoring, consider eBPF-based threat detection for kernel-level visibility and secure coding practices to reduce vulnerabilities at the source.

Vulnerability management is a program, not a project. Build for sustainability, scalability, and automation from day one.

---

Sources

1. NIST National Vulnerability Database (NVD) - The largest public CVE repository (378,000+ records) with CVSS scores, Common Platform Enumeration (CPE) data, and remediation guidance. Since 2024 NVD has not enriched most CVEs with CVSS and CPE data; as of April 2026 it prioritises only KEV, federal, and EO 14028 critical software, so it can no longer be treated as a complete correlation substrate.

2. CISA Known Exploited Vulnerabilities (KEV) Catalog - Cybersecurity and Infrastructure Security Agency’s catalog of 1,600+ vulnerabilities with confirmed active exploitation with confirmed active exploitation in the wild. Established by CISA Binding Operational Directive 22-01, which obligates federal civilian agencies to remediate listed CVEs by a per-entry due date; entries added since mid-2026 are governed by BOD 26-04 and best-practice prioritization guidance for all organizations, updated continuously as new exploits emerge.

3. FIRST.org CVSS v3.1 Specification - Severity scoring system superseded by CVSS v4.0 in 2023, but still what NVD itself publishes maintained by the Forum of Incident Response and Security Teams (FIRST). Provides consistent vulnerability severity assessment across base score (inherent characteristics), temporal score (exploit availability), and environmental score (organizational impact).

4. FIRST.org Exploit Prediction Scoring System (EPSS) - Probability-based framework estimating the likelihood of vulnerability exploitation within 30 days. Uses machine learning models analyzing 1,000+ features including exploit code availability, social media mentions, and threat intelligence feeds to prioritize remediation beyond CVSS severity alone.

5. NIST Special Publication 800-53 Rev. 5 - Comprehensive security and privacy control catalog for federal information systems and organizations. Defines vulnerability scanning requirements (RA-5) including frequency, coverage scope, remediation tracking, and information sharing that form the compliance foundation for federal and many commercial vulnerability management programs.

6. Trivy - Container Vulnerability Scanner - Aqua Security’s open source vulnerability scanner supporting container images, filesystems, Git repositories, and infrastructure as code. Detects OS packages (Alpine, RHEL, Debian, Ubuntu, etc.) and language-specific dependencies (npm, pip, Maven, etc.) with comprehensive CVE database coverage and SBOM generation capabilities.

7. Grype - Vulnerability Scanner for Container Images and Filesystems - Anchore’s open source scanner providing fast vulnerability detection against multiple databases (NVD, GitHub Security Advisories, OS-specific feeds). Supports SBOM ingestion via Syft, making it ideal for CI/CD pipeline integration where build-time vulnerability blocking is required.

8. Greenbone Vulnerability Management (GVM) / OpenVAS - Comprehensive open source vulnerability scanner maintaining 90,000+ network vulnerability tests (NVTs). Provides authenticated and unauthenticated scanning, compliance policy checks, and extensive CVE coverage rivaling commercial platforms. The community edition offers full scanning capabilities without licensing restrictions.

9. OSV.dev - Open Source Vulnerabilities Database - Distributed vulnerability database aggregating data from GitHub Security Advisories, PyPI, RustSec, and other ecosystem-specific sources. Provides precise affected version ranges and standardized JSON format ideal for automated tooling integration, particularly strong for open source dependency vulnerabilities.

10. Apache Airflow Documentation - Workflow orchestration platform enabling programmatic scheduling and monitoring of complex data pipelines. In vulnerability management contexts, Airflow DAGs coordinate multi-stage scanning workflows (discovery → scan → normalize → dedupe → ticket creation) with dependency management, retry logic, and detailed execution logging.

11. Wazuh Open Source Security Platform - Unified XDR and SIEM platform providing intrusion detection, vulnerability detection, compliance monitoring, and threat intelligence integration. Deploys agents to endpoints for continuous monitoring and integrates with vulnerability scanners to correlate detected vulnerabilities with actual exploitation attempts in real-time.

12. OWASP Top 10 Web Application Security Risks - Open Web Application Security Project’s definitive awareness document identifying the most critical security risks to web applications. Updated every 3-4 years; the 2025 edition is built from data covering more than 2.8 million applications, providing the vulnerability categories that web application scanners prioritize in their detection rules.

13. SANS Vulnerability Management Maturity Model - Framework for assessing and improving vulnerability management program maturity across five levels — Initial, Managed, Defined, Quantitatively Managed, and Optimizing — assessed across five areas: Prepare, Identify, Analyze, Communicate, Treat (continuous improvement, predictive analytics). Provides roadmap for organizations evolving from ad-hoc scanning to enterprise-scale vulnerability programs.