Runtime filtering of computer system vulnerabilities

One or more non-transitory, computer-readable media storing computer-executable instructions which, when executed, causes one or more processors to perform a method of managing computer vulnerabilities, the method comprising:

• detecting one or more processes running on a computing system;
• determining a first set of vulnerabilities that are associated with the one or more processes from a plurality of vulnerabilities;
• determining, for each vulnerability in the first set, context metadata related to a process or an application associated with the vulnerability, the context metadata including (1) runtime metadata indicating how often the application has been executed or for how long the process has been running, and (2) vulnerability metadata indicating vulnerability severity, attack type, or availability of a solution for the vulnerability;
• generating a second set of vulnerabilities, that is a subset of the first set of vulnerabilities, based on the context metadata of the vulnerabilities in the first set;
• and
• transmitting information related to the second set of vulnerabilities to a device.