A critical vulnerability is discovered in an internet-facing service; a third-party library is found to have a known exploitable weakness; and the patch window closed two weeks ago. Many Swedish IT departments at medium-sized organizations recognize this pattern. With the NIS2 Directive, which is implemented in Swedish law through the Cybersecurity Act, the requirements for systematic vulnerability management have become both clearer and more stringent.
This guide helps you, as an IT or security manager, evaluate and adapt your organization’s threat and vulnerability management so that it meets NIS2 requirements, with a particular focus on endpoint visibility and risk-based prioritization.
In this article, we’ll walk you through what NIS2 requires, how to build a structured process for vulnerability management, and what criteria should guide your choice of platform.
Key takeaways: Threat and vulnerability management to comply with NIS2
- NIS2 and by extension, the Cybersecurity Act requires documented, risk-based vulnerability management that is supported by senior management and continuously monitored.
- Endpoint visibility is the foundation, you cannot protect what you cannot see in your IT infrastructure.
- Prioritizing based on business impact yields better results than sorting solely by CVSS scores.
- Inuit helps organizations combine vulnerability scanning with patch management from a central console.
- Automated workflows for remediation and verification reduce the time between detection and protection.
What is threat and vulnerability management?
Threat and vulnerability management is the continuous process of identifying, assessing, prioritizing, and remediating security flaws in an organization’s IT infrastructure. It involves systematically mapping weaknesses in operating systems, applications, network devices, and endpoints before attackers have a chance to exploit them.
Unlike one-off vulnerability scans or penetration tests, vulnerability management is an ongoing cycle. The process includes asset inventory, automated scanning, manual validation, risk-based prioritization, remediation through patching or configuration changes, as well as verification and follow-up.
The goal is to move from reactive “firefighting”—where you address vulnerabilities after an incident—to a proactive approach where you identify and manage risks before they cause harm. This means that the IT department takes on a strategic role in the organization’s security efforts.
Why NIS2 makes vulnerability management mandatory in Sweden
The NIS2 Directive, which is implemented in Sweden through the Cybersecurity Act (2025:1506), sets explicit requirements for risk management for organizations in critical and important sectors. The law took effect on January 15, 2026, and the detailed regulations on security measures apply as of October 1, 2026.
Article 21 of NIS2 requires, among other things, risk analysis and the security of information systems, as well as vulnerability management and vulnerability disclosure. This means that you can no longer treat vulnerability scanning as a voluntary project. It must be a documented, recurring process with clear ownership.
According to guidance from the National Cybersecurity Center (NCSC), cybersecurity efforts must be systematic and risk-based. Security measures must be designed to address risks that threaten network and information systems, including supply chain management.
Which organizations are covered by NIS2 in Sweden?
NIS2 covers organizations in a wide range of sectors classified as critical or important. Energy, transportation, healthcare, water supply, digital infrastructure, public administration, and financial services are examples of sectors directly affected.
Medium-sized organizations, often defined as companies with 50 or more employees, are now included within the scope of the directive. This represents a tightening of requirements compared to the previous NIS Directive. Suppliers to these organizations may also be affected by supply chain security requirements.
If your organization manages critical infrastructure or provides services on which other businesses depend, you should assume that NIS2 applies to you. Oversight is conducted on a sector-by-sector basis, and the responsible authority varies depending on the industry.
The key requirements for vulnerability management in NIS2
NIS2 does not specify any tools or technical solutions. The directive requires a risk-based approach with concrete measures. Here are the requirements that directly pertain to threat and vulnerability management.
Risk analysis and risk management
You must continuously identify and assess risks to your network and information systems. This means that vulnerability scanning and threat assessment must be integrated into your risk management process, not separate ad hoc activities.
Vulnerability management and disclosure
The organization must have a process for receiving, assessing, and addressing information about vulnerabilities. This includes monitoring published CVEs (Common Vulnerabilities and Exposures) and having procedures for coordinated vulnerability disclosure.
Incident reporting
Security incidents must be reported within established timeframes. An effective log management and SIEM solution facilitates both the detection and reporting of incidents related to exploited vulnerabilities.
Management’s responsibility
NIS2 places responsibility for cybersecurity at the management level. Management must approve security measures, undergo training, and be held accountable. This means that vulnerability management must be reported upward with clear metrics and timeframes.
Supply chain security
You are also responsible for setting security requirements for your suppliers. This includes verifying that the software and services you procure do not contain known vulnerabilities, for example through SBOM (Software Bill of Materials) management.
How to build a process for risk-based vulnerability management
Compliance with NIS2 requirements isn’t just about purchasing a tool. It’s about building a structured, recurring process. Here’s a step-by-step guide tailored for Swedish medium-sized organizations.
Step 1: Inventory all assets in your IT infrastructure
You can’t protect what you don’t know you have. Start by taking inventory of all servers, workloads, network devices, applications, cloud resources, and endpoints. Automated discovery tools help, but manual validation is required to identify so-called shadow IT.
Many organizations discover that a significant portion of their resources are missing from the official asset registry. These are resources that no one is accountable for but that may still be exposed to the internet.
Step 2: Perform regular vulnerability scans
Run automated scans tailored to each asset type: infrastructure, web applications, containers, and cloud configurations. Schedule the scans to run at least weekly for critical infrastructure and with every deployment in the CI/CD pipeline.
Vulnerability Manager Plus offers comprehensive vulnerability scanning and remediation management for all endpoints in your network. The tool combines scanning with patch management in a single console.
Step 3: Validate and contextualize the results
Automated scans often produce hundreds of findings. An experienced security analyst needs to review the results to eliminate false positives, assess business impact, and identify vulnerability chains where individual moderate-severity flaws collectively constitute a critical attack vector.
A vulnerability with a CVSS 7.0 score in a payment system may be more urgent than one with a CVSS 9.0 score in an isolated test environment. Context is key.
Step 4: Prioritize Based on Business Impact
Raw CVSS scores are not enough. Combine technical severity with exploitability (are there public exploits, is the vulnerability actively being exploited?), asset exposure, business criticality, and any mitigating controls such as network segmentation or WAF rules.
The result is a prioritized action list with clear timeframes: critical (within 24 to 72 hours), high (within one to two weeks), medium (within 30 days), and low (during the next maintenance window).
Step 5: Remediate through patching and configuration
Patching is the most common remedy, but it requires testing before production deployment. When immediate patching isn’t possible—for example, in older OT systems—mitigating measures such as segmentation, restricted connections, and enhanced logging are required. Document each exception with management approval.
Step 6: Verify, document, and follow up
Always run a rescan after remediation to verify that the vulnerability has actually been eliminated. Document the entire process, from discovery to remediation, to demonstrate compliance during audits. A good report includes an executive summary, a detailed technical report, trend analysis, and recommendations.
Recommended frequencies for vulnerability scanning
NIS2 does not specify exact intervals, but a risk-based approach requires regularity. Here is a framework that works for most medium-sized Swedish organizations.
Critical infrastructure, such as internet-facing servers and network devices, should be scanned at least weekly. Applications and APIs should be scanned with every deployment and additionally on a weekly basis. Cloud configurations should be continuously monitored in real time using CSPM (Cloud Security Posture Management) tools.
Manual validation and prioritization should be performed monthly, while management reports with trend analysis should be presented quarterly. In-depth penetration tests are recommended every six months or annually as a complement to ongoing scanning.
Organizations lacking the internal capacity to maintain these frequencies can benefit from automated solutions. Vulnerability Manager Plus can be scheduled to run scans automatically and generate remediation reports without manual intervention.
The difference between vulnerability management and penetration testing
A common misconception is to equate vulnerability management with penetration testing. They serve different purposes and complement each other.
Vulnerability management aims to provide a broad assessment of known weaknesses across the entire environment. It primarily uses automated scanning tools, runs frequently, and produces a prioritized list of remediation recommendations based on CVSS scores and business context.
Penetration testing is a more in-depth, focused effort in which a security specialist actively attempts to exploit specific vulnerabilities. It is typically performed once or twice a year and provides a detailed attack narrative with evidence of what an attacker can actually achieve.
Organizations that rely on only one of these miss half the picture. Vulnerability management provides the breadth needed to meet NIS2’s requirements for continuous risk management. Penetration testing provides the depth that reveals whether your security measures actually hold up under pressure.
Endpoint visibility: The foundation of NIS2 compliance
Endpoints (workstations, laptops, servers, and mobile devices) often constitute the largest attack surface in an organization. Without complete visibility into these devices, you lack the foundation needed to make the right decisions regarding prioritization and remediation.
Endpoint visibility means you can see in real time which devices are on your network, which operating systems and applications they’re running, which patches are missing, and what configuration discrepancies exist. Endpoint Central provides vulnerability management, automated patching, asset intelligence, remote troubleshooting, and attack surface management—all from a single console.
According to the U.S. International Trade Administration (2026), cyberattacks in Sweden increased by 70 percent in the first quarter of 2025 compared to 2024. This makes proactive endpoint management a necessity rather than a luxury.
Criteria for evaluating a vulnerability management platform
Choosing the right platform isn’t about finding the one with the most features. It’s about finding the one that fits your organization’s size, technical maturity, and regulatory requirements. Here are the criteria you should use as a starting point.
Coverage of asset types
The platform should be able to scan operating systems, applications, network devices, cloud configurations, and endpoints. A solution that covers only part of your infrastructure leaves blind spots.
Risk-based prioritization
The tool should offer more than just raw CVSS scores. You need to be able to factor in business criticality, exposure, and threat intelligence to prioritize actions based on their impact on operations.
Integrated patch management
A platform that combines vulnerability scanning with patch management reduces overhead and shortens the time between detection and remediation. It’s advantageous if scanning and patching are performed from the same console.
Compliance reporting
NIS2 requires documentation and the ability to demonstrate compliance during audits. The platform should offer predefined reports for regulatory review, including trend analysis and remediation status.
Scalability and Support for Nordic Organizations
If you operate in Sweden and the Nordic region, you need a provider that understands local regulatory requirements and offers support in Swedish. Inuit specializes in handpicking smart IT security solutions for Nordic organizations.
How to handle systems that cannot be patched
Not all systems can be patched immediately. Older OT (Operational Technology) systems, medical devices, and industrial control systems often have limited update capabilities. NIS2 still requires you to manage the risks associated with these systems.
Mitigation measures are key. Network segmentation isolates vulnerable systems from the rest of the infrastructure and limits an attacker’s ability to move laterally. Restricting connections reduces the attack surface by closing ports and protocols that are not actively used.
Enhanced logging and monitoring enable you to detect anomalous behavior in real time, even if the underlying vulnerability remains. Log360 is a SIEM tool that collects and analyzes logs to provide you with early warning of potential intrusions.
Any exemption from patching must be documented with a risk assessment, mitigating measures, and a time-limited approval from management. It is this documentation that the regulatory authority wants to see during an audit.
Common mistakes in vulnerability management under NIS2
Many organizations fall into the same pitfalls when building their vulnerability management program. Knowing them in advance saves time and reduces risk.
Scanning but not remediating
The most common shortcoming. The organization invests in tools and runs regular scans, but the report ends up in an inbox without anyone taking ownership of the remediation work. The solution is to integrate remediation into existing ITSM workflows with clear SLAs for each priority level.
Focuses solely on infrastructure
Application vulnerabilities, cloud configuration flaws, and third-party libraries are often overlooked. A misconfigured cloud service or a vulnerability in an API can be just as serious as an unpatched server.
Lacks an up-to-date asset inventory
Shadow IT and forgotten test environments often pose the greatest risk. Without a complete inventory, you also cannot demonstrate regulatory compliance, since you don’t know what you need to protect.
Treating it as a one-time project
A single vulnerability scan per year provides a snapshot, not protection. New CVEs are published daily. NIS2 requires a continuous, recurring approach with clear frequencies and assigned responsibilities.
How Inuit helps you manage vulnerabilities and address NIS2 requirements
Inuit offers a wide range of IT security solutions that together cover the entire chain from detection to remediation. Vulnerability Manager Plus and WithSecure Exposure Management provide vulnerability scanning and remediation management (patching, etc.) for all endpoints on your network. Endpoint Central automates vulnerability management, patching, asset management, and configuration control from a central console. Patch Manager Plus helps you patch Windows, Mac, Linux, and third-party products.
Log360, a unified SIEM tool, helps organizations detect, respond to, and mitigate cyberattacks with advanced threat analysis, which directly supports NIS2’s incident reporting requirements.
By working more proactively and taking control of resources, your IT department can transition from reactive firefighting to methodical, data-driven decision-making. That is the core of what Inuit does.
The supply chain: An often-overlooked vulnerability focus
NIS2 sets requirements for supply chain security, which means your organization’s responsibility extends beyond its own systems. Software from third-party vendors, open-source code, and cloud services all constitute potential entry points for attackers.
SBOM (Software Bill of Materials) management makes it possible to track which components and libraries are included in the software you use. When a new vulnerability is disclosed in a third-party component, you can quickly determine whether your organization is exposed.
Include requirements for vendors in contracts, request documentation regarding their vulnerability management, and verify that they comply with recognized frameworks such as ISO/IEC 27001. Continuous monitoring of known vulnerabilities in vendors’ products should be part of your regular scanning process.
Checklist: Getting started with NIS2-Compliant vulnerability management
Use this checklist as a starting point to structure your work. It covers the most important steps to get started.
- Inventory all assets, including endpoints, cloud resources, and IoT devices.
- Implement automated vulnerability scanning at least once a week for critical systems.
- Establish a risk-based prioritization model that takes business criticality and exposure into account.
- Link remediation efforts to your ITSM process with defined SLAs for each priority level.
- Automate patch management for operating systems and third-party applications.
- Document the entire process, from scanning to verification, for regulatory review.
- Ensure that management regularly reviews reports ontrends and resource requirements.
- Review vendors’ security practices and require SBOMs for critical software.
Conclusion: Proactive vulnerability management strengthens your organization
NIS2 raises the bar for what is required of Swedish organizations’ cybersecurity efforts. Threat and vulnerability management is no longer an optional add-on—it is a fundamental requirement. By building a structured, risk-based process with the right tools and clear accountability, you can meet regulatory requirements while strengthening your organization’s resilience against cyber threats.
Start by mapping your assets and scanning your environment. Prioritize based on business impact and automate remediation efforts. Inuit can help you take control of your IT infrastructure and move from a reactive to a proactive approach to protection.
