Vulnerability management identifies, validates, and records design-flaw exposures with a defined disclosure-and-remediation process.

Vulnerability management is a relevant security process, but its scope is collecting and evaluating known technical vulnerabilities, not detecting the bespoke time-triggered implant EX-0008 uses, so addresses rather than mitigates.

Vulnerability management identifies, validates, and tracks both inherited and own software vulnerabilities, the catalog from which EX-0009 picks.

Vulnerability management identifies, validates, and tracks OS-level defects including those potentially inherited from external sources, the catalog EX-0009.02 leverages.

Vulnerability management is the canonical operator-side defense against publicly known defects in COTS/FOSS components — the literal subject of EX-0009.03.

Vulnerability management on the operator's systems closes the gaps adversary-obtained exploits target and reduces their value, but it does not prevent the resource-development acquisition of exploits RD-0003.01 performs, so addresses rather than mitigates.

Vulnerability Management governs the operator collection and evaluation of known vulnerabilities, the domain REC-0008.03 mines, reducing exposure rather than actively defending against the reconnaissance itself.