This blog was originally published on May 4, 2023, and updated on March 10, 2025.
A few years ago, David Hazar and I created the Vulnerability Management Maturity Model (VMMM) to help organizations gauge the maturity of their vulnerability management programs. The original blog series on the model is still available for reference.
Since then, I've regularly been asked if there's a tool to help assess where an organization stands within the maturity model. In response, I created the VMMM Self-Assessment Tool (VMMM-SAT). I know… I SAT on the VMMM. (You went there… I know you did. But at least we have that out of the way.)
VMMM-SAT 2.0 – New & Improved!
If you work in vulnerability management (VM), you already know that keeping up with threats is like playing whack-a-mole—on expert mode, with no breaks. That’s why we created the VMMM and the VMMM-SAT – to help you assess where your program stands and identify areas of improvement.
After incorporating feedback, real-world usage insights, and lessons learned, I decided it was time to upgrade the VMMM-SAT!
What is the VMMM-SAT?
The VMMM-SAT is a self-assessment tool designed to evaluate your organization's vulnerability management maturity, built on the renowned SANS Vulnerability Management Maturity Model (VMMM). It is an interactive Excel spreadsheet that uses a series of questions to determine your organization’s maturity level. It provides insights across all 12 focus areas of the model, helping you assess your program's effectiveness and provide valuable feedback to your leadership team.
By answering a series of simple YES/NO questions, you will gain a clear understanding of how mature your vulnerability management program is.
What’s New?
Clearer, More Actionable Questions – We refined the wording of each question to better reflect real-world VM programs. No more ambiguity—just direct, insightful, and relevant assessments.
New Individual-Level Assessment – I’ve added a new component to help understand the completeness of each maturity model level. Below is an example of the summary:
The updated VMMM-SAT is live on GitHub. Check it out here!
But That’s Not All… Something Big is Coming
We’re planning a major update to the full VMMM before the end of summer 2025! This will be a complete ground-up refresh, reflecting the latest trends in vulnerability prioritization, attack surface management (ASM), exposure management, and more. Stay tuned—you won’t want to miss it.
Want to Go Deeper?
If you like the VMMM-SAT, you’ll love SANS LDR516TM: Building and Leading Vulnerability Management ProgramsTM. This course goes well beyond self-assessments—covering maturity models, validation techniques, and leadership strategies to help you build and lead a holistic, risk-focused VM program.
Try the new VMMM-SAT, watch for the big update, and if you’re serious about VM, check out the LDR516 course!
What do you think of the latest updates? Drop your thoughts and tag me on LinkedIn.
About the Author: Jonathan Risto
With over 20 years of experience spanning network design, IP telephony, service development, security, and project management, Jonathan brings a deep technical background that provides a wealth of information he draws upon when teaching. Currently, he conducts cybersecurity research for the Canadian Government, focusing on vulnerability management and automated remediation. He is also an independent security consultant.
Jonathan is a coauthor and SANS Certified Instructor for LDR516: Building and Leading Vulnerability Management Programs.
