When vulnerability databases are no longer enough

Vulnerability management has relied on a relatively straightforward model where vulnerabilities are identified, their severity assessed and those considered most critical for remediation are prioritised.