Critical Vulnerability Management (CVM) Risk Vector: Core Overview

Critical Vulnerability Management (CVM) is a risk vector in the Diligence risk category. It measures how an organization manages publicly disclosed software vulnerabilities on its internet-facing infrastructure. Bitsight grades CVM using the Common Vulnerability Scoring System (CVSS) score of each vulnerability and how long it stays unpatched.

What changed on July 16, 2026?

On July 16, 2026, Bitsight renamed the Patching Cadence risk vector to CVM as part of the Ratings Algorithm Update 2026 (RAU26). Patching Cadence and CVM do not appear in the rating at the same time. Patching Cadence was retired when CVM took effect. Historical observations remain unchanged.

CVM uses the same set of vulnerabilities that Patching Cadence tracked. The change affects how severity and duration influence the grade. Severity now has a larger effect. High-severity vulnerabilities that are patched quickly raise the grade more quickly, and long-running low-severity findings have a smaller effect.

CVSS scores are also refreshed in this update. When a vulnerability’s CVSS score changes in the Bitsight catalog, the change applies automatically.

Grades and ratings may move in either direction. Organizations that patch high-severity vulnerabilities quickly may see an improvement. Organizations with high-severity vulnerabilities that remain unpatched may see a decrease. The model is designed to be size-agnostic, so company size does not change the calculation.

For the full announcement, see Patching Cadence Risk Vector has been reconfigured to Critical Vulnerabilities Management.

For all RAU26 changes, see Ratings Algorithm Update (RAU26) - July 16, 2026.

Vulnerabilities can expose organizations to malicious attacks. Reacting quickly to vulnerabilities is critical for reducing cyber risk. 

• A Bitsight study demonstrated that organizations with a poor CVM grade experience a nearly sevenfold increase in the likelihood of a ransomware event.

Best Practices for Remediating Findings

To maximize your score and strengthen your security posture:

• Prioritize High CVSS Scores: Focus your remediation efforts on the most severe vulnerabilities first.
• Target Long-Running Findings: Reduce your average time-to-remediate by addressing vulnerabilities that have existed in your network the longest.
• Automate Updates: Ensure your operating systems and supporting libraries are kept up-to-date, and implement automatic updates for critical systems.
• Monitor Vendors: Understand how quickly your critical vendors patch their vulnerabilities, as weak links in your supply chain can expose you to significant risk.
• Consistency Matters: Because BitSight looks at a weighted average over time, one or two "outlier" vulnerabilities left unpatched for months can drag down the average, even if most other items are fixed quickly.

How is my grade calculated?

To calculate your CVM grade, Bitsight measures how quickly you remediate vulnerabilities relative to their severity.

How it Works

• Your grade is based on your weighted average time-to-remediate, not the total number of vulnerabilities or assets you have.
• High-severity vulnerabilities (Material or Severe) impact your grade more significantly than Minor ones if left unpatched.
• Critical Vulnerability Management accounts for 20% of the Diligence category.
  • Since the Diligence risk category represents 71.5% of your overall BitSight rating, maintaining a fast patching cycle is one of the most effective ways to improve or stabilize your score.

In summary: To maintain a high grade, focus on patching critical vulnerabilities as fast as possible.

Learn more about CVM calculations here.

What does my grade mean?

• A grade indicates your organization is performing better than most of your peers on vulnerability remediation speed.
• Grades are derived from observed remediation behavior (e.g., time to patch, consistency of patching) across the organization’s internet-facing footprint.

How long does a finding affect my grade?

• Impact is calculated from the day a vulnerability is First Seen until it is Last Seen.
• A finding is marked "fixed" once a patch is detected or the asset is unreachable for 60 days.
• After remediation, a finding stays on your record for 90 days. Its impact is highest on day one and fades to zero over the three-month period.
• If the same vulnerability reappears within 180 days, the original duration is extended rather than starting fresh.

In summary: Patching quickly limits the initial damage, while staying clean for 90 days fully clears the impact from your score.

Where can I view my CVM Grades and Findings?

You can view CVM findings on the Findings Table and CVM grades on the Ratings Details page.

Findings Table Navigation Options:

• SPM App: Findings ➔ Findings Table
• CM App: Companies List ➔ Vendor Risk ➔ Findings
• Insurance: Companies List ➔ Client Risk ➔ Findings
• API: GET /v1/companies/entity_guid/findings?risk_vector=patching_cadence

Ratings Details Page Navigation Options:

• SPM App: Organization ➔ Ratings Details
• CM App: Vendor Risk ➔ Ratings Details
• Insurance: Client Risk ➔ Rating Details

The Rating Details page includes a graph that shows the number of vulnerabilities experienced per month, along with the average resolution time for the month.

1 Year Summary of Patching Cadence Observations

• A higher bubble indicates a longer average resolution timespan for that month.
• Larger bubbles indicate there were more unpatched vulnerabilities observed during that time period.

Where can I learn more?

• How is the Critical Vulnerability Management (CVM) risk vector assessed?: the full CVM methodology.
• Why do findings have a decay and lifetime period?
• How is the Diligence risk category calculated?: scanning and rescan of findings.