Vulnerability management requires a focus on the weaknesses that involve people, processes and business relationships, as well as technology.
https://www.securitymagazine.com/articles/96155-true-vulnerability-management-involves-much-more-than-updates