Vulnerability management and risk management have the same objective: to reduce the probability of the occurrence of detrimental events. What are the differences between them? Multiple choice question. Risk management is often a more complex and strategic process using a bottom-up, asset-based approach in planning. Vulnerability management is top-down and often uses an IT risk-based approach in the process. Risk management is often a more complex and strategic process that should be a long-term process. Vulnerability management is often a tactical and short-term effort using a top-down approach in evaluating the IT risks