What is the difference between security configuration management and vulnerability management?

More context

The tooling markets split the same way: vulnerability management platforms (Tenable, Qualys, Rapid7) are organized around CVE detection and patch prioritization, with configuration assessment as a secondary feature. Configuration-first platforms are organized around baselines, drift, and framework evidence. Compliance frameworks generally require both disciplines, but under different control families.

Misconfiguration is consistently cited among the leading causes of breaches, and it is the failure mode vulnerability scanning does not see: an open management port, a disabled audit log, or an anonymous-access setting carries no CVE. That gap is why regulated environments run a dedicated configuration compliance program alongside vulnerability management.