Threat management is typically conducted using which approach?

• A. A combination of automated and manual scanning tools
• B. Unassisted manual review only
• C. Only external vulnerability databases
• D. No scanning; expect risk mitigation by policy

Answer: (A)

Threat management works best when automated scanning and human review are used together. Automated tools continuously scan and monitor networks, systems, and third-party connections, quickly identifying vulnerabilities, misconfigurations, and suspicious activity at scale. Manual analysis then adds essential context: security professionals validate findings, assess exploitability and business impact, prioritize remediation based on asset criticality, and ensure changes align with policy and incident response plans. This combination covers both breadth and depth—automation provides fast, broad detection, while human judgment handles false positives, evolving threats, and risk-based decision making. Relying solely on manual review would be too slow and miss breadth, and relying only on external vulnerability databases would fail to capture internal exposures and zero-day or context-specific risks.