# Design a vulnerability management platform: system design interview question

> Asset identity, vulnerability applicability, disclosure updates, and reliable remediation status across infrastructure changes.

Source: https://sysround.com/questions/design-vulnerability-management-platform
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a platform that inventories enterprise assets, identifies known vulnerabilities, and prioritizes remediation. It must track findings as infrastructure and vulnerability information change."

## What to clarify first

- Assets and data sources
- Enterprise scale
- Traffic and read:write mix
- Advisory catalog
- Latency and freshness
- Consistency, availability, and durability
- Source behavior
- Priorities and workflow
- Retention and record sizes
- Security and deployment scope

## Scope of a strong answer

Core requirements:

- Maintain an asset inventory from external sources.
- Identify known vulnerabilities from package evidence and current advisories.
- Prioritize findings with asset context and exploit evidence.
- Track remediation and finding history as assets and advisories change.

Usually out of scope:

- Implement agents or active network scans.
- Discover previously unknown vulnerabilities.
- Install patches or run exploit tests.

## What interviewers probe

### Asset identity and history

Addresses repeat, sources disagree, and late reports can make an old vulnerability appear current or make a current vulnerability disappear.

### Vulnerability applicability

Package names and version strings do not fully describe vulnerability status, especially when vendors backport fixes or feeds disagree.

### Disclosure updates at scale

One disclosure can affect millions of assets while new inventories and advisory corrections continue to arrive.

### Remediation priorities and proof

A useful priority needs asset context, while remediation status must distinguish verified fixes, accepted risk, and missing evidence.

## Common mistakes

- Uses an IP address as asset identity and mixes the histories of different machines.
- Matches package names and versions without ecosystem or vendor context.
- Reevaluates every asset against every advisory after each disclosure.
- Treats incomplete scans or missing reports as proof of remediation.
- Combines accepted risk, ticket completion, and verified fixes into one status.
- Shows current risk totals without source age or evaluation coverage.

## The bar by level

- **Senior:** Defines stable identity and finding transitions. Handles advisory revisions, targeted reevaluation, stale results, and resumable work. Separates technical evidence from workflow and meets freshness targets.
- **Staff+:** Defines correctness across concurrent source changes. Quantifies broad disclosure costs and tenant fairness. Proves evaluation coverage and explains uncertain evidence, historical audit, and regional ownership.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=vulnerability-management


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.