PDQ vulnerability management: Find, prioritize, and fix

PDQ consolidates vulnerability management into one workflow: Identify known vulnerabilities on managed endpoints, prioritize findings, and deploy remediations to affected devices. It combines vulnerability information with patching capabilities so your team can move from identifying a problem to addressing it in the same tool. 

A vulnerability report is a starting point, not a finished job. You still need to know whether a finding applies to your environment, how urgently to address it, and whether the fix worked. Another spreadsheet does not answer those questions for you. 

Getting those fixes deployed and verified takes time, too. In PDQ’s 2026 State of Sysadmin report, 51% of respondents identified timely security patch implementation as one of their most tedious and time-consuming tasks. 

Here’s how PDQ connects vulnerability detection, prioritization, and remediation, and how to put that workflow into practice. 

How does PDQ identify vulnerabilities? 

PDQ scans managed devices for known operating system and software vulnerabilities and identifies which devices are affected. That gives you a starting point for investigating the software and systems in your environment, rather than treating every newly published vulnerability as your problem. 

A CVE, or Common Vulnerabilities and Exposures identifier, identifies a publicly disclosed vulnerability. Common Platform Enumeration (CPE) identifiers help determine the software products and versions associated with known vulnerabilities.The next question is whether the affected software and version are present on your endpoints. 

Identify vulnerable software beyond application names 

PDQ’s in-house CVE-to-software matching engine uses software fingerprinting signals such as binary paths, version metadata, operating systems, CPU architecture, running process information, and registry indicators. These signals help identify installed components and versions instead of relying only on an application’s display name. 

Consider a desktop application that includes its own Python runtime. Updating a separately installed copy of Python would not necessarily update that bundled copy. Identifying the affected component helps you investigate the appropriate vendor-supported fix instead of updating the wrong installation. 

The useful question is not just, “Which application is installed?” It is, “Which component and version need attention?” 

Check Windows patch levels 

PDQ’s Windows patch detection includes Knowledge Base (KB) and update build revision (UBR) information. KB numbers identify Microsoft updates, including updates for Windows and components such as .NET Framework, while UBR indicates the Windows OS patch level. Together, they provide more detail than an operating-system name, helping distinguish the Windows release from its installed patch level. 

Knowing that a device runs Windows is not the same as knowing a particular security fix is installed. Patch-level information helps make that distinction when investigating operating system vulnerabilities. 

Together, software identification and patch-level analysis provide a more specific starting point for remediation than a list of product names alone. 

How does PDQ prioritize vulnerabilities? 

PDQ uses the PDQ Risk Score to prioritize detected vulnerabilities. Its inputs include the CVSS score, access levels, exploitability, and weaponization, giving sysadmins a way to assess findings using more than a severity rating alone. 

A Common Vulnerability Scoring System (CVSS) base score measures technical severity, not the complete risk to your organization. FIRST, the organization behind CVSS, specifically cautions against using the base score alone to assess risk. 

PDQ’s broader prioritization approach also draws on sources such as vendor advisories, open-source intelligence, and CISA’s Known Exploited Vulnerabilities (KEV) catalog. Those sources add context beyond the vulnerability’s severity rating. 

For example, CISA adds vulnerabilities to the KEV catalog based on evidence of active exploitation. That is a different signal from knowing that a vulnerability could be exploited under certain conditions. 

Use the ranking to guide triage, then add the context your team knows best. Does an affected device support a business-critical service? Is it exposed to the internet? Would remediation require a carefully planned maintenance window? 

The score helps organize the work. Your knowledge of the environment helps determine how to carry it out. 

How does PDQ help remediate vulnerabilities? 

PDQ lets you deploy remediation packages to affected devices from the vulnerability workflow. When a suggested package is available, it has already been tested and verified by our engineers. You can select that update; otherwise, choose an appropriate Package Library package or create a custom package for the required fix. 

When no ready-made package is available, review the remediation requirements to determine whether a custom package is appropriate. 

Use maintained, tested deployment packages 

PDQ’s Package Library provides ready-to-deploy packages for commonly used applications, with updated packages published as vendors release new versions. That removes the need to build and maintain every supported application package yourself. 

PDQ’s in-house package creation process includes deployment testing, antivirus and behavior-based scanning, and verification by a second engineer. These checks reduce packaging and validation work for your team so that you can focus on testing updates against your organization’s configurations before a broad rollout. 

The practical benefit is a shorter path from identifying an affected application to deploying an appropriate update. 

Automate repeatable patching 

PDQ can automate deployments on recurring schedules or when a package is updated. You can target those automations to selected devices or groups and use the latest package version where that fits your patching policy. 

Choose the latest package version for ongoing updates, or pin a specific version when you need deployments to stay on that release. 

You don’t have to automate every application at once. In PDQ’s 2026 State of Sysadmin report, 61% of respondents reported partially automated patch management, while 16% reported full automation.

Start with update workflows you have validated, and keep a review process for exceptions and business-critical applications. 

How do you scan, prioritize, and remediate with PDQ? 

Start with the vulnerability findings, review their priority and affected devices, and select an appropriate remediation. After deployment, review the results and refresh vulnerability data to verify the outcome.

1. Scan managed devices. Open Vulnerabilities in the left navigation, then select Scan to initiate an on-demand vulnerability scan. 

2. Review the risk-based ranking. Findings appear in descending order by PDQ Risk Score by default. Filters let you narrow the list by affected software, CVSS score, known exploit, status, or impacted device count. 

3. Inspect the findings. Open a vulnerability to review its description, impacted devices, and any available resolution. Confirm which software or operating system version the remediation requires. 

4. Test and deploy the fix. Use a suggested remediation package when available, or select another suitable package. Test on representative devices before deploying more broadly, and complete any required restarts. 

5. Verify the result. Review deployment results. Vulnerability data will refresh automatically after deployment, so confirm the expected version or patch level is installed. Investigate failed deployments, offline endpoints, and findings that remain unresolved. 

6. Automate ongoing updates. Configure a recurring or package-update-triggered automation for tested update workflows. Track incompatible applications, unreachable devices, and other exceptions for follow-up. 

7. Report. For compliance purposes, prove the work has been performed. 

The goal is a repeatable cycle: identify what is vulnerable, prioritize what matters, deploy the fix, and verify the outcome. The PDQ Risk Score supports prioritization, while the connected detection and patching workflow helps move findings toward resolution.