Critical Vulnerability Management (CVM) Risk Vector: Core Overview

The Critical Vulnerability Management (CVM) risk vector is a part of the the Diligence risk category. CVM measures how an organization manages publicly disclosed software vulnerabilities. Bitsight grades CVM from the Common Vulnerability Scoring System (CVSS) score and the duration of each unpatched vulnerability on the organization's internet-facing infrastructure.

• Risk Category: Diligence
• Default Grade: A
• Current Rating Impact: 20%
• Finding Lifetime: 90 Days; A CVM finding affects the grade for 90 days after its Last Seen date.
• Scan Cadence: Automated every 30 days; Daily automated scans for EASM Enhanced customers.
• Eligible for Dynamic Remediation? No.

What happened to the Patching Cadence risk vector?

On July 16, 2026, Bitsight renamed the Patching Cadence risk vector to CVM as part of the Ratings Algorithm Update 2026 (RAU26). CVM replaced Patching Cadence in the Bitsight Security Rating. The two risk vectors do not appear in the rating together.

The CVM methodology differs from the Patching Cadence methodology in these ways:

• The CVSS score of a vulnerability is the most impactful factor in the grade. Scores of 9.0 or 10.0 have the largest influence.
• The time a vulnerability stays unpatched still affects the grade, but with less impact than severity. A vulnerability that stays unpatched for hundreds of days lowers the grade more than one that Bitsight observes for a short time.
• The model uses a logarithmic scale. [Confirm the customer-facing wording and what the scale applies to (severity, duration, or both).]
• The set of vulnerabilities that Bitsight tracks did not change. The change affects how severity and duration affect the grade.
• Bitsight continues to count the duration of vulnerabilities observed before July 16, 2026. Improvements in current remediation behavior raise the grade gradually.
• Risk vector grades and ratings may shift. Entities that remediated high-severity vulnerabilities quickly may see an improvement. Entities with high-severity vulnerabilities that stay unpatched may see a decrease.

For the full announcement, see Patching Cadence Risk Vector has been reconfigured to Critical Vulnerabilities Management.

For all RAU26 changes, see Ratings Algorithm Update (RAU26) - July 16, 2026.

Vulnerabilities can expose organizations to malicious attacks. Reacting quickly to vulnerabilities is critical for reducing cyber risk. 

• A Bitsight study demonstrated that organizations with a poor CVM grade experience a nearly sevenfold increase in the likelihood of a ransomware event.

Best Practices for Remediating Findings

To maximize your score and strengthen your security posture:

• Prioritize High CVSS Scores: Focus your remediation efforts on the most severe vulnerabilities first.
• Target Long-Running Findings: Reduce your average time-to-remediate by addressing vulnerabilities that have existed in your network the longest.
• Automate Updates: Ensure your operating systems and supporting libraries are kept up-to-date, and implement automatic updates for critical systems.
• Monitor Vendors: Understand how quickly your critical vendors patch their vulnerabilities, as weak links in your supply chain can expose you to significant risk.
• Consistency Matters: Because BitSight looks at a weighted average over time, one or two "outlier" vulnerabilities left unpatched for months can drag down the average, even if most other items are fixed quickly.

How is my grade calculated?

To calculate your CVM grade, Bitsight measures how quickly you remediate vulnerabilities relative to their severity.

How it Works

• Your grade is based on your weighted average time-to-remediate, not the total number of vulnerabilities or assets you have.
• High-severity vulnerabilities (Material or Severe) impact your grade more significantly than Minor ones if left unpatched.
• Critical Vulnerability Management accounts for 20% of the Diligence category.
  • Since the Diligence risk category represents 71.5% of your overall BitSight rating, maintaining a fast patching cycle is one of the most effective ways to improve or stabilize your score.

In summary: To maintain a high grade, focus on patching critical vulnerabilities as fast as possible.

Learn more about CVM calculations here.

What does my grade mean?

• A grade indicates your organization is performing better than most of your peers on vulnerability remediation speed.
• Grades are derived from observed remediation behavior (e.g., time to patch, consistency of patching) across the organization’s internet-facing footprint.

How long does a finding affect my grade?

• Impact is calculated from the day a vulnerability is First Seen until it is Last Seen.
• A finding is marked "fixed" once a patch is detected or the asset is unreachable for 60 days.
• After remediation, a finding stays on your record for 90 days. Its impact is highest on day one and fades to zero over the three-month period.
• If the same vulnerability reappears within 180 days, the original duration is extended rather than starting fresh.

In summary: Patching quickly limits the initial damage, while staying clean for 90 days fully clears the impact from your score.

Where can I view my CVM Grades and Findings?

You can view CVM findings on the Findings Table and CVM grades on the Ratings Details page.

Findings Table Navigation Options:

• SPM App: Findings ➔ Findings Table
• CM App: Companies List ➔ Vendor Risk ➔ Findings
• Insurance: Companies List ➔ Client Risk ➔ Findings
• API: GET /v1/companies/entity_guid/findings?risk_vector=patching_cadence

Ratings Details Page Navigation Options:

• SPM App: Organization ➔ Ratings Details
• CM App: Vendor Risk ➔ Ratings Details
• Insurance: Client Risk ➔ Rating Details

The Rating Details page includes a graph that shows the number of vulnerabilities experienced per month, along with the average resolution time for the month.

1 Year Summary of Patching Cadence Observations

• A higher bubble indicates a longer average resolution timespan for that month.
• Larger bubbles indicate there were more unpatched vulnerabilities observed during that time period.

Where can I learn more?

• How is the Critical Vulnerability Management (CVM) risk vector assessed?: the full CVM methodology.
• Why do findings have a decay and lifetime period?
• How is the Diligence risk category calculated?: scanning and rescan of findings.