A repeatable monthly cycle for small teams: keep an asset list, scan on a fixed schedule, prioritize by real exposure, fix in waves, and record every decision.

CVEs name vulnerabilities, not verdicts. Here is how to read an identifier, decode a CVSS vector, and build a patching order that matches your real exposure.