Security weakness tracking
FunctionOne tracks the weaknesses in your systems that need fixing. Open fixes stay visible.
FunctionOne cybersecurity
FunctionOne tracks the security weaknesses that need fixing
Vulnerability management is the ongoing work of tracking security weaknesses until they're fixed, and FunctionOne's vulnerability management services keep that list for your organization. Fixing speed matters because attackers go after known flaws that stay open. FunctionOne scopes the service apart from monitoring, ties it to patching and device care, and shows leadership open remediation and repeat findings in the regular security review.
Book a security assessment
We'll review your systems and accounts, then agree scope and response rules with you before anything is switched on.
We use your details only to arrange your assessment.
What FunctionOne vulnerability management includes
FunctionOne vulnerability management covers the tracking and reporting below, scoped to the systems we agree on together.
Assessment before setup
Your first step with FunctionOne is a security assessment. We review systems and accounts, then agree on scope and response rules before anything is switched on.
Scoped apart from monitoring
Vulnerability management has its own scope, separate from monitoring. Our security analysts watch connected systems 24/7, and you agree with us on what weakness tracking covers.
Patching and device care
On the managed IT side, vulnerability management works with patching and device care. Weaknesses that need a fix tie into everyday IT work.
Penetration testing
Vulnerability management also works with penetration testing.
Owners and next steps
FunctionOne reports to leadership with owners and next steps, so you know who is fixing what.
Security review visibility
Leadership sees open remediation and repeat findings in the regular security review. A monthly summary goes to leadership as well.
Managed or co-managed
The service works for fully managed IT or co-managed IT beside your in-house IT team.
Why does fixing speed matter to FunctionOne clients?
Exploiting vulnerabilities is now the most common way into a breach, ahead of stolen-credential abuse, according to Verizon's 2026 Data Breach Investigations Report. A vulnerability is a weakness in software or settings that an attacker can use to get in. The longer a known flaw stays open, the more time attackers have to find it.
CISA's Known Exploited Vulnerabilities Catalog (2026) lists flaws that attackers have exploited in the wild, with more than 1,700 entries as of October 2026. In that 2026 catalog, CISA says to use the list as an input to prioritization. A flaw on the list has already been used in attacks, which gives patch prioritization a clear starting point. With FunctionOne, leadership can see which fixes are still open in the regular security review.
CISA's 2026 CISA Vulnerability Review looked at fiscal 2024 and 2025 data and finds that basic security failures enable most compromises. In the same 2026 review, CISA reports that attackers scan for exposed, well-known software vulnerabilities. At FunctionOne, security is part of everyday IT work, and vulnerability management works with patching and device care. Repeat findings show up in the regular security review, so leaders can see when the same weakness comes back.
How does FunctionOne run vulnerability management?
FunctionOne takes vulnerability management from a first assessment through to a leadership review.
Security assessment first
FunctionOne starts with a security assessment that reviews your systems and accounts.
Agree scope and rules
We agree on scope and response rules with you before anything is switched on. Vulnerability management gets its own scope, separate from monitoring.
Track weaknesses to fix
We track the security weaknesses that need fixing.
Patch and test
Fixes go through patching and device care on the managed IT side. Vulnerability management also works with penetration testing.
Report to leadership
Your leadership sees open remediation and repeat findings in the regular security review, with owners and next steps.
How does FunctionOne vulnerability management compare with monitoring?
FunctionOne scopes vulnerability management and security monitoring separately, so leaders can compare what they get from each.
| Vulnerability management | Security monitoring |
|---|---|
| Tracks security weaknesses that need fixing | Security analysts watch connected systems 24/7 |
| Scoped on its own after the security assessment | Scoped on its own, with response rules you approve |
| Leaders see open remediation and repeat findings | Leaders get a monthly summary and a regular security review |
Who is FunctionOne vulnerability management for?
FunctionOne vulnerability management fits established mid-size and large organizations that have outgrown a help desk.
Owners and executives
You report to a board, insurer, auditor or parent company. Your security review shows open remediation and repeat findings, with owners and next steps.
IT directors with staff
FunctionOne can work co-managed beside your in-house IT team. Patching and device care on the managed IT side work with vulnerability management.
Organizations with several offices
FunctionOne runs offices, laptops, phones, servers and cloud from one control point.
High-stakes operations
Security is part of everyday IT work at FunctionOne. Weaknesses that need fixing are tracked and reported to leadership.
What do leaders ask FunctionOne about vulnerability management?
What is vulnerability management?
Vulnerability management is the ongoing work of tracking security weaknesses that need fixing and getting them fixed. At FunctionOne, we scope it separately from monitoring and run fixes through patching and device care, so leaders can see what's open and who owns it.
Why does fixing speed matter for vulnerabilities?
Fixing speed matters because attackers go after known weaknesses. Verizon's 2026 Data Breach Investigations Report found that exploiting vulnerabilities is now the most common way into a breach, ahead of stolen-credential abuse. FunctionOne tracks open fixes so leaders can see what still needs attention.
How should we decide which patches to fix first?
CISA's Known Exploited Vulnerabilities Catalog, which lists more than 1,700 entries as of October 2026, tracks flaws exploited in the wild, and CISA says to use it as an input to prioritization. FunctionOne agrees scope with you after the security assessment.
Does CISA's three-day patch deadline apply to our company?
No, it doesn't. CISA's Patch Smarter, Not Harder guidance (2026) applies its three-day deadline for the highest-risk group only to federal civilian agencies, and it ranks fixes by public exposure, automated exploitation, full system control and exploitation seen in the wild. FunctionOne agrees scope before anything is switched on.
How is vulnerability management different from security monitoring?
FunctionOne scopes them separately. Vulnerability management tracks weaknesses that need fixing, while security analysts watch connected systems 24/7 and contain threats only within response rules you approve. Your leaders see results in the monthly summary and regular security review.
Can FunctionOne work alongside our in-house IT team?
Yes, FunctionOne offers co-managed IT beside an in-house team, as well as fully managed IT. Patching and device care on the managed IT side work with vulnerability management and penetration testing, and your leaders see open remediation and repeat findings in the regular security review.
What will our board see from vulnerability management?
Your leadership sees open remediation and repeat findings in FunctionOne's regular security review, along with a monthly summary. FunctionOne reports with owners and next steps.
Sources
- Verizon, 2026 Data Breach Investigations Report, 2026
- CISA, Known Exploited Vulnerabilities Catalog, 2026
- CISA, Patch Smarter, Not Harder, 2026
- CISA, CISA Vulnerability Review, 2026