A key to having a good information security program within your organization is having a strong vulnerability management program. This allows you to identify critical risks and help your organization reduce its attack surface area. Most, if not all, regulatory policies and information security frameworks advise that having a strong vulnerability management program is one of first things an organization should do when building their information security program. Using the Capability Maturity Model (CMM) as the framework to measure the maturity of an organization's infosec program by examining their vulnerability management program, this talk will outline the five stages of maturity based on CMM and give you an idea as to how to take your organization the next level of maturity.