A system for automatically managing vulnerabilities may determine vulnerability data describing vulnerabilities in an information technology environment and then assign each vulnerability to a stakeholder for remediation. The system may receive a remediation proposal from the stakeholder, obtain approval for the remediation proposal, and facilitate remediation of the vulnerability based on the proposal.