INVICTUSCYBERSECURITY

Bienvenidos, San Antonio · 25% off all cybersecurity services, now through December 31, 2026. See what qualifies →

✕

VM3

Vulnerability Management Maturity Model (VM3)

PDF
Research Paper
Aguero, E. (2026). VM3: A Vulnerability Management Maturity Model.
A 5-level maturity model (Reactive through Strategic) for vulnerability management programs, graded across five dimensions: Scan Coverage, Triage Quality, Remediation Ops, Stakeholder Engagement, and Visibility & Reporting. Where linear models reduce a program to one number, VM3 exposes the dimensional variance that drives actual prioritization. Includes mappings to NIST 800-171 (CMMC), PCI DSS v4.0, and SOC 2. CC BY 4.0.
Request the paper ↓
INVICTUS CYBERSECURITY

Vulnerability Management Maturity Model · VM³ v0.1

Click a cell to mark your current level · Hover for details

OVERALL MATURITY
—
VM³ v0.1 · INVICTUS CYBERSECURITY · invictuscybersecurity.tech · © 2026 Emmanuel Aguero · CC BY 4.0

Get the paper

Read the full VM3 model.

The complete paper: all five maturity levels, the five operational dimensions, the scoring rubric, and mappings to NIST 800-171 (CMMC), PCI DSS v4.0, and SOC 2.

VM3 is published under CC BY 4.0 — yours to use, adapt and share with attribution. We ask for an email so we know who’s using it and can send you updates when the model changes. Nothing else.

See how we run engagements on VM3

Send me the VM3 paper

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

The paper and occasional field notes. We don’t sell or share your details.