Which sources are used to identify new security vulnerabilities in the vulnerability management process?

• A. Internal memos
• B. Vendor newsletters
• C. Reputable outside sources
• D. Social media

Answer: (C)

Staying informed about newly disclosed vulnerabilities relies on trusted external vulnerability intelligence sources. These outlets publish vetted advisories with CVE IDs, severity ratings, affected products, and recommended mitigations, enabling you to update scanning signatures, prioritize patches, and implement fixes quickly. Internal memos stay within the organization and may miss external issues, so they’re not the primary way to identify new vulnerabilities. Vendor newsletters can be helpful for product-specific alerts but don’t always cover all affected products or broader vulnerability trends. Social media can spread rumors or unverified claims, which makes it unreliable as the main source of vulnerability information. Reputable outside sources provide timely, credible, and comprehensive vulnerability data that your vulnerability management process should rely on.