Vulnerability and exposure
Scanner findings, scored and attached to the assets they actually affect.
Vulnerability management
Import from Tenable or a Nessus file, or record manually. Each finding is linked to its asset, scored, and given an owner and a due date. Where a vulnerability matters enough, promote it into the risk register with the link preserved.
Key capabilities
- Tenable adapter and Nessus file import
- CVSS scoring and severity
- Asset linkage and ownership
- Promotion into the risk register
- Remediation tracking against SLA
FYI Threats: exploit intelligence
A medium-severity vulnerability being exploited today outranks a high-severity one nobody can reach. Threat and exploit intelligence is correlated to what you actually run, turning a scanner backlog into a queue somebody can work.
Key capabilities
- Exploit availability correlated to your vulnerabilities
- Threat intelligence synchronised on a schedule
- Prioritisation by exploitability, not just severity
Breach Risk
The question a board asks the morning after somebody else's breach. Breached credentials tied to your domains, look-alike domain registrations and network-level observations, rolled into a rating with the detail underneath it.
Key capabilities
- Breached-credential exposure for your domains
- Look-alike and typosquat domain detection
- Network and infrastructure observations
- Composite rating with the underlying checks visible
- Alerting when exposure changes
Proof point
Exploit availability is the practical filter. A medium-severity vulnerability being exploited today is ranked above a high-severity one nobody can reach.
Questions about this
What SLAs do auditors expect for vulnerabilities?
A documented policy, typically critical within 7 to 14 days, high within 30, medium within 90, and evidence that findings were remediated within it.
Do we need a penetration test?
Most frameworks and customers expect one annually. It is separate from the platform fee and paid to the testing firm.
How is vulnerability evidence collected?
From scanners and security tools through integrations, with findings, age against SLA and remediation tickets mapped to the control.
What is the difference between a scan and a penetration test?
A scan is automated and continuous; a penetration test is a manual, authorised attack simulation with a report. Auditors want both.