Ongoing practice of identifying, classifying, prioritizing, remediating, and mitigating software vulnerabilities.