# Improving Vulnerability Management Through Process Mining
## 5 Conclusions  
How can process mining be used to improve vulnerability management through better process monitoring? This question mainly means finding ways to make remediation faster but also making sure that remediation is performed properly and permanently. Even though the most researched process mining topic is process discovery, the use case in the presented project has shown that process discovery alone does not lead to valuable results. Instead, making the process faster can mainly be achieved by using process enhancement since that approach provides the throughput time between activities. Using this throughput time as well as dimensions such as the source, priority, or assignment group allows vulnerability managers to know exactly where time is lost. Process mining can then be used for a root cause analysis, which can lead to uncovering bigger problems, such as misconfigurations of sources, or just to obtaining data-based improvement ideas, such as giving better training to certain assignment groups or automating the assignment process. The data mining results might also be useful for achieving better support from stakeholders since they can be made aware of the consequences that their behavior has on the entire process. In order to ensure that the vulnerabilities are remediated properly and permanently, process discovery mixed with process conformance provides valuable improvement ideas. It is important to note here that process conformance is only helpful for this goal if proper  
Figure 17: Process explorer dashboard. remediation is connected to following a defined process model. It was argued in this thesis that skipping certain activities or following certain process flows lead to vulnerabilities not being remediated correctly. Most of the results found with process conformance were already discovered by looking at the discovered process model with a good knowledge of the target process. Process conformance can mainly give support by giving an overview of all found violations. So, while process discovery can be useful for deeper analysis of proper remediation, process conformance is more useful for monitoring the process violations. Finally, by using an effective process mining tool, the vulnerability management process can be improved continuously by providing the above-mentioned information on a daily basis with flexible dashboards. Based on this work, we recommend the introduction of direct group assignments to remediate vulnerabilities and automate false positive classifications. It is important to note that process mining, as an approach connected to data mining, does not in itself improve the effectiveness of the vulnerability management process but rather supports the improvement by giving valuable insights into the real process. The use case showed that one limitation of the approach was that the results have to be interpreted and improvement ideas have to be generated by the process owner. Process mining can then be used to monitor the success of the improvement ideas. However, process simulation techniques and process mining techniques combined with AI might be approaches for working on those limitations [44; 45; 46]. We would also like to briefly discuss the limitations of our contribution. First, the potential impact of data quality and the exclusion of certain tables on the results may affect the comprehensiveness and accuracy of the findings. Second, this paper emphasizes practical applications over theoretical contributions, which limits its potential to advance the theoretical foundations of vulnerability management and process mining. Developing an innovative theoretical framework or model that integrates process mining with cybersecurity principles could enhance this study's academic and practical impact. Building on the recommendations to address process bottlenecks--such as improving response team training and optimizing the configuration of scanning tools--future research could focus on the quantitative validation of these proposed improvements.