IICTI Certified Vulnerability Management Specialist

Holders demonstrate that they can apply and evaluate attack surface management and asset intelligence, scanning architecture, coverage and accuracy engineering, risk-based vulnerability prioritization and continuous threat exposure management programme design, plus 7 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Vulnerability Management Specialist.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Attack surface management and asset intelligence9% of the exam

   • Design asset discovery and attribution processes that give complete, owned coverage of the attack surface.
   • Scope: External attack surface management, CAASM, CMDB reconciliation, cloud and shadow IT discovery, certificate and DNS intelligence, asset criticality and ownership attribution.
2. 02Scanning architecture, coverage and accuracy engineering11% of the exam

   • Architect a scanning capability whose coverage and accuracy are measured and continuously validated.
   • Scope: Authenticated vs unauthenticated scanning, agent-based and agentless approaches, scan scheduling and network impact, false positive/negative analysis, coverage metrics and scanner validation.
3. 03Risk-based vulnerability prioritization15% of the exam

   • Evaluate and prioritize vulnerabilities by real-world exploitation likelihood and business impact rather than severity alone.
   • Scope: CVSS v4.0 base, threat and environmental metrics, EPSS, CISA KEV, SSVC decision trees, threat intelligence enrichment, exploitability and reachability analysis, business context scoring.
4. 04Continuous threat exposure management programme design5% of the exam

   • Lead a continuous exposure management programme that links findings to attack paths and business risk.
   • Scope: CTEM scoping, discovery, prioritization, validation and mobilization stages, attack path analysis, exposure management platforms and integration with security operations.
5. 05Cloud, container and infrastructure-as-code vulnerability management8% of the exam

   • Design vulnerability controls for cloud-native environments where assets are ephemeral and code-defined.
   • Scope: CSPM and CNAPP, container image scanning, Kubernetes misconfiguration, IaC scanning (Checkov, tfsec), runtime vs build-time findings, ephemeral asset tracking.
6. 06Application and software supply chain vulnerability management8% of the exam

   • Evaluate software and dependency vulnerabilities and govern remediation across the delivery pipeline.
   • Scope: SAST, DAST, SCA and secrets scanning in CI/CD, SBOM (SPDX, CycloneDX), VEX statements, OSV and GitHub advisories, dependency reachability, SLSA and open source risk.
7. 07OT, IoT and unmanaged device vulnerability management5% of the exam

   • Design vulnerability management for environments where active scanning and patching are constrained.
   • Scope: Passive discovery for OT, IEC 62443 constraints, ICS advisories, firmware and end-of-life devices, compensating controls where patching is infeasible, safety-aware testing.
8. 08Remediation orchestration, SLAs and exception governance18% of the exam

   • Lead remediation workflows that achieve SLA compliance and keep accepted risks documented and time-bound.
   • Scope: Ownership routing and ticketing integration, risk-based SLAs, patch and configuration remediation workflows, risk acceptance and exception lifecycle, compensating control validation.
9. 09Exposure validation and adversarial testing integration5% of the exam

   • Evaluate exploitability evidence from validation activities to confirm or reprioritize remediation decisions.
   • Scope: Breach and attack simulation, automated penetration testing, purple team feedback loops, rules of engagement and scope governance, using validation results to reprioritize exposures.
10. 10Coordinated vulnerability disclosure and zero-day response8% of the exam

    • Lead coordinated disclosure and emergency response for critical and actively exploited vulnerabilities.
    • Scope: ISO/IEC 29147 and 30111, PSIRT operations, bug bounty governance, CVE/CNA processes, EU CRA reporting obligations, emergency response playbooks for actively exploited zero-days.
11. 11Vulnerability metrics, reporting and programme maturity8% of the exam

    • Design metrics and reporting that demonstrate programme effectiveness and risk reduction to leadership and regulators.
    • Scope: MTTR and exposure window metrics, risk burn-down, coverage and SLA KPIs, executive and board reporting, maturity models, regulatory alignment (NIS2, DORA, PCI DSS v4.0 Req. 6 and 11).

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner