A personal home-lab running a full vulnerability-management cycle: scan → prioritise → remediate → re-scan. I took a Windows 10 VM from 47 vulnerabilities on the first scan to a verified zero-risk state over 8 iterative scans.
Finding vulnerabilities is easy; closing the loop is the actual job. This lab practises the complete vulnerability-management lifecycle on an isolated Windows 10 VM — running credentialed and non-credentialed scans with Tenable Nessus Essentials, prioritising findings by CVSS v3, remediating across legacy software and OS components, and re-scanning until the risk was verifiably gone.
⚠️ Ethics & scope: All scanning was performed against a Windows 10 VM I built inside an isolated VirtualBox Host-Only network. No external or third-party systems were touched.
flowchart LR
A[Scan<br/>Nessus Essentials] --> B[Prioritise<br/>CVSS v3]
B --> C[Remediate<br/>patch · update · harden]
C --> D[Re-scan<br/>verify fix]
D -->|residual findings| A
D -->|clean| E[Zero-risk state ✓]
- Built the target — a Windows 10 VM in Oracle VirtualBox on an isolated Host-Only network (scanner ↔ target only, no internet exposure), deliberately left with legacy software and unpatched components; Windows Defender Firewall disabled on the target to allow comprehensive port scanning and network-based inspection.
- Scanned — launched a Basic Network Scan from Nessus Essentials against the target (
192.168.56.101) to establish a baseline: 47 vulnerabilities identified, including severe gaps in outdated third-party software (Google Chrome) and deprecated Microsoft OS components. - Prioritised the findings via the Nessus Remediations tab, ordered by CVSS v3 severity — Critical/High first.
- Remediated — removed/updated highly vulnerable legacy software, applied critical Microsoft Windows cumulative updates, and addressed network configuration gaps (SMB Signing requirements).
- Re-scanned iteratively — 8 scan cycles, confirming each fix and catching newly surfaced items, until reaching a verified zero-risk state.
| Metric | Value |
|---|---|
| Vulnerabilities at baseline | 47 |
| Prioritisation method | CVSS v3 severity |
| Remediation cycles | 8 iterative scans |
| Final state | 100% of Critical/High/Medium/Low mitigated — 0 actionable findings (3 informational logs remaining) |
Tenable Nessus Essentials · CVSS v3 · Oracle VirtualBox (Host-Only network) · Windows 10 · Endpoint Hardening · Patch Management · Vulnerability Assessment
- Why raw vulnerability counts mean little without risk-based prioritisation — CVSS turns a scary list into an ordered plan.
- That remediation is iterative: fixing one thing can reveal or change others, so re-scanning to verify is non-negotiable.
- How to read a Nessus report the way a real vulnerability-management program would.
Kuldeep Mishra — aspiring SOC Analyst. 📧 km828591@gmail.com · 🔗 LinkedIn · 💻 GitHub