The future of vulnerability management

I while back I wrote a piece on vulnerability management being dead.  This was followed with what I thought was one of the great panels of all times on the future of VM on our podcast. One thing that was clear to me was that vulnerability scanners and assessment tools were going to be used for different uses than they have been in the past.  Whether for configuration management or as part of a policy driven network as I wrote about yesterday, people want more than just scanning and reporting.  Another example of this is the deal announced yesterday between eEye and BMC.  BMC will use scanner data to augment and correlate with their business management intelligence. This will provide hopefully better risk management and compliance to their customers.  Again a different use for vulnerability scanners than traditional scan and report for vulnerabilities.

Congratulations to Ross and the rest of the team over at eEye on the deal.