1. A computer-implemented method for vulnerability risk management of an enterprise computer system, comprising the steps of: receiving, by an expert system, a list of potential vulnerabilities of the enterprise computer system from a vulnerability risk management module, wherein the expert system and the vulnerability risk management module are instantiated by a cloud computing system; converting a potential vulnerability on the list of potential vulnerabilities into a set of facts; verifying that the potential vulnerability is not a false positive by testing a rule against the set of facts; executing an action associated with the rule that modifies a fact of the set of facts to produce a modified set of facts when the conditions of the rule have been satisfied; incorporating the modified set of facts into a refined list of vulnerabilities; and transmitting the refined list of vulnerabilities to the vulnerability risk management module.