SQL Vulnerability Management Analytics

Project Overview

This independent cybersecurity portfolio project demonstrates how SQL can support vulnerability management by combining asset criticality, vulnerability severity, remediation status, ownership, and service-level targets.

The project is designed to show practical security analytics rather than simple SQL syntax. It uses relational joins, CASE expressions, CTEs, subqueries, window functions, and remediation aging logic to prioritize security work.

Skills Demonstrated

• SQL
• Relational database design
• Vulnerability management analytics
• Asset and vulnerability joins
• CVSS-based prioritization
• CASE expressions
• Common Table Expressions (CTEs)
• Window functions
• Aggregations
• Subqueries
• Remediation SLA analysis
• Security risk reporting

Project Files

• schema.sql — Relational database structure
• sample_data.sql — Fictional assets, vulnerabilities, findings, and remediation owners
• analysis_queries.sql — Core vulnerability-management queries
• advanced_queries.sql — CTEs, ranking, overdue analysis, and risk scoring
• findings.md — Analyst interpretation of the dataset
• README.md — Project documentation

Security Questions Answered

• Which assets have the most vulnerabilities?
• Which findings are Critical or High severity?
• Which critical assets have overdue remediation?
• Which business units carry the most vulnerability exposure?
• Which remediation owners have the largest open workload?
• Which vulnerabilities exceed SLA targets?
• How can vulnerabilities be ranked within each asset?
• Which assets have the highest combined security risk?

Cybersecurity Relevance

Vulnerability-management teams need to prioritize thousands of findings based on severity, exploitability, asset importance, remediation age, and business impact. SQL can help transform raw scanner findings into actionable remediation priorities and management reporting.

Portfolio Note

This is an independent cybersecurity portfolio project created for educational and professional demonstration. All assets, vulnerabilities, dates, owners, and findings are fictional.