Attack surface management
Track known vulnerabilities in your assets as risks
Certifyi checks the assets in your inventory against published vulnerabilities and links each match to the risk register, where it gets an owner, a severity and a date for the fix.
In short
A vulnerability is only managed once someone owns it. Certifyi matches the assets in your inventory against the National Vulnerability Database and links each finding to the risk register, where it has an owner, a severity and a due date.
Known vulnerabilities, matched to your assets
Certifyi checks the assets recorded in your inventory against the National Vulnerability Database (NVD) on a schedule. When a published vulnerability matches an asset, the finding is linked to that asset and to the risk register.
- Remediation
- Each finding has an owner, a due date and a status until it is closed.
- Waivers
- Accept the risk on a specific finding, with a written justification and an expiry date.
- Risk register
- Findings appear as risks beside the rest of your programme, with likelihood, impact and treatment.
Getting useful results
Matching is only as good as the inventory behind it.
-
Record versions
An asset listed without a version cannot be matched reliably.
-
Name an owner
Findings on an asset with no owner tend to sit untouched.
-
Set waiver expiry dates
Accepted risk should be looked at again. An expiry date makes sure it is.
Related modules
A vulnerability finding is linked to the asset it affects and appears in the risk register. If it is exploited, the response is handled in incident management.
How Certifyi helps
Vulnerability findings with an owner
Known vulnerabilities in your assets, recorded in your risk programme.
-
NVD matching
Assets in your inventory checked against the National Vulnerability Database.
-
Linked to risk
Findings appear in the risk register with an owner and a severity.
-
Remediation and waivers
Assign, track and close findings, or accept the risk with a written justification.
Questions
Attack surface questions
Where do the vulnerability findings come from?
Certifyi matches the assets in your inventory against the National Vulnerability Database. Results depend on how completely the inventory records your software and versions.
Can we accept the risk on a specific finding?
Yes. A waiver records the justification and an expiry date, after which the finding needs another look.
Why keep this in the GRC platform?
Because a known vulnerability is a risk, and your auditor will ask how it was handled. With findings, assets and the risk register in one workspace, the path from finding to fix is in one record.
Give every known vulnerability an owner
Book a demo to see NVD matching and the risk register links on an example asset inventory.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them