Vulnerability Response process is typically described as half automated and half manual as you can see in this schema:

Let's focus on the manual part of the process, if you are interested in the automated part please click here