The Risk Rancher Field Manual, Ch. 1: Do You Even Need a Fence?
Part of The Risk Rancher Field Manual, a hands-on guide to starting, scaling, and running a vulnerability management program.
Before you spend a dollar on a scanner, answer a harder question: do you need a vulnerability management program at all, and if so, how big?
Most people get this backwards. They buy the tool first, because the tool is the thing with a sales rep and a budget line. Then they spend a year drowning in its output, trying to build a program around a firehose they already turned on. Do it the other way. The program is the thing. The tools serve it.
Do you need one?
You need a program the moment three things are true at once: you have something worth protecting, you have more of it than you can hold in your head, and someone, a customer, a regulator, or an attacker, is eventually going to check.
Usually it shows up as a specific event. A customer sends you a security questionnaire with two hundred questions and a signed deal waiting on the other side. An auditor asks for your “vulnerability management policy” and you realize the honest answer is a shrug. Or you get popped, and in the postmortem everyone stands around asking why the thing that got you had a patch available for eight months.
Any one of those is your starting gun. And if none of them have happened yet, congratulations: you have the rarest thing in this field, time to build the fence before the wolves show up.
How much is enough?
The harder question is not whether, it is how much. This is where programs die, in both directions. Too little, and you have a scanner nobody reads and a dashboard that lies to you in green. Too much, and you have built an enterprise bureaucracy for a twelve-person company, and it collapses under its own ceremony the first week somebody is actually busy.
Right-size it to what you are:
- Startup (one app, a handful of engineers, cloud everything): your entire program can be a scanner wired into CI, one prioritized list, and a weekly fifteen-minute triage. One person, part-time. Do not build committees. Build a habit.
- Mid-market (a few products, real IT, a compliance need creeping in): now you need the actual engine, triage, remediation, exceptions, and a handful of metrics, and one person who owns it. This is the sweet spot this book is written for.
- Enterprise (many teams, many scanners, auditors who live in your calendar): all of the above, plus the thing big shops always under-invest in: deduplication and ownership. Your problem is not finding vulnerabilities. It is that you have forty thousand of them spread across six tools and no idea who owns what.
Notice what did not change across those three: the work. Triage, remediate, except, repeat. A startup does it in an afternoon and an enterprise does it with a platform and a team, but it is the same four moves. That is good news. It means you can learn the whole game while you are small and just scale the muscle, instead of learning a different game every time you grow.
Do not boil the ocean
One rule before we go anywhere, because it saves more programs than any tool: do not try to cover everything.
You do not need to inventory every asset, scan every port, and fix every finding. You need to find the handful of things that would actually end you, and protect those first. The critical database. The public-facing app. The box that holds the domain admin credentials. Get those right and you have handled most of your real risk for a fraction of the effort. The rest is cleanup, and cleanup can wait its turn.
Try it. Right-size yourself before you spend a dollar. Answer three questions: (1) Do you have something worth protecting that is bigger than you can hold in your head? (2) Has a customer, auditor, or attacker started checking, or will they soon? (3) Could you name, right now, the one person who owns this program? If the answers are yes, yes, and no, your first task is not a scanner, it is picking that owner. Then circle your tier from the list above, and write the single sentence that is your whole program this quarter: “We will triage, remediate, and track findings on [these crown jewels] every [week], owned by [name].” That sentence is the program. Everything after it is just scale.
So: do you need a program? Almost certainly, and sooner than you would like. How much? Exactly enough to cover what would genuinely hurt, and not one committee more.
In the next chapter we go find out what you actually have, because the first thing every one of these programs trips over is the same: you cannot protect, or even count, a ghost.